Alina Latinina - The Sisterhood of the Traveling Threat Models: Privacy Isn’t One-Size-Fits-All

All right. So, I like to keep my talks short and sweet, and I'm very happy with this audience turnup because I have debilitating stage anxiety, and this actually feels really cozy and nice. Um, all right. So, the name is a bit tricky, the Sisterhood of Traveling Threat Models. Um, how many of you know what I'm referring to by the sisterhood of traveling something?

No one. Okay. So, I think uh let me start with uh explaining. So, it's actually a movie that was popular 10 years ago and it was called the sisterhood of of the traveling pants and it's uh four girls that um you know bonded over their experiences. a bit of coming of age movie and they all share the pants not at the same time but they give the pants to each other as somebody goes traveling somewhere goes through a period of their life so that's why it's traveling pants because the pants go in different situations and kind of evolve and you know someone puts a little design here somebody cuts them and um bear with me I will explain how that's relatable later now let's go back so I'm Alina I am from web privacy now and women in privacy So it's a bit tricky to explain because it's basically one collective.

So WebC privacy now um how many of you have been at the event yesterday? I think almost everyone here and um it's a collective that uh promotes privacy and it's open source and its donations run. Uh you know how like my favorite way to describe it, you know how when you come to like an event and it's sponsored by something and you just have the logos shield in your face everywhere and it feels so depersonalized and it feels so you know in a s way. Uh so web privacy now doesn't do that [ __ ] So what we do is we partner with organizations that align with our ethos and um actually you know um do support the work that we do but in a you know public goods way. Uh women in privacy on the other hand is a task force on top of web three privacy now.

So it's all the same collective but um let me explain it in these terms that I explained yesterday. We um we set up integrations on top of existing events to make events a bit more fun to make events a bit more relatable and human. So we have safe events initiative which is a toolkit that we're developing to be distributed to communityr run events because as we know community organizers are working their asses off and most of the time they don't have time to think about the little things while organizing an event. So you don't you know you don't see a lot of awareness teams or you know safe corners or you know like report buttons like QR code that you can scan on the wall. um bigger events usually integrate that.

But um for smaller hackathons, for smaller events, we want to create a toolkit that we can send them like maybe a little workshop, maybe some suggestions on what to integrate in your event. Um and preferably someone from our team to kind of facilitate safe space for, you know, any kind of potential harassment or if somebody is just simply overstimulated and they need like a moment to themselves, like with someone else, but without that someone asking 18,000 questions. And um yeah, so it's a bit of a integrating the human layer on top of this um privacy collective. So I've went over this and um so the traveling model of the threat model I I forgot the name of the presentation. Sorry.

But what is a threat model? What do we mean by that? So what are we protecting and who are we protecting when we talk about privacy? And why are we protecting and what are the tools that you're protecting with? um big questions and when you think about privacy um do you want to scream out some you know associations that you get like a word when I say privacy what's the first thing that comes to your head secrets okay anyone else what anonymous

security

encryption backloaf what do you what's the first thing that comes to your head when I say privacy encryption is not enough. That's many words but but passes. Anyone else? Okay. So, the common model that everybody thinks of and I I love my collages.

So, I created a little one. Well, actually this is not a collage yet, but it does have a little meme. So, mainstream privacy threat models are usually, you know, people usually think of like the government spying on you. And there's a there's a meme that's kind of it not it's not a meme, but it's just like the screen from the show that I saw once on someone's Twitter and I couldn't find it for the life of me, but it basically says the first is like, oh, isn't it nice to feel like somebody's always watching over you and it's like, oh, that's so sweet. Yeah, unfortunately it's the government.

And then when you also think of privacy, you might think of like Mr. Robot or somebody hacking into a system, somebody doing, you know, uh maybe shady stuff. what privacy threat model should actually look like. So when you think about privacy, you should be thinking of activists that are going to protests that uh might be targeted if you're not in a you know very particularly nice country or a country that's open to different kinds of protests unless it's a fascist protest uh which which has happened in Rome before and I do not support that. It's uh privacy for sex workers.

It's uh privacy for journalists that are, you know, writing about a certain government and might be targeted by a certain government for the stuff that they write. And uh they can be in a particularly tricky situation as we all know, especially political journalists. Uh people traveling. So for example, um right now at the US borders, they are legally allowed to go through your phone. And for example, if you're, you know, if you're a queer activist or if you're trans, you might be denied entry to the United States or you might have problems depending on which state and so many different things like that that we normally wouldn't think of.

Uh friends being kidnapped as uh somebody here told me a story of um their friend being kidnapped in I think it was uh Latin America. they were kidnapped by a cartel and then the first thing that the cartel did was to destroy the phone. So all the you know tracking devices um you know tracking location would be off and also simply for tracking your girly's location on the night out and you would just want to make sure that they all get home safe. So this is the privacy that you would think of uh that you should think of when you say privacy and uh it's not necessarily you know fancy tools. It's not necessarily, you know, setting up nodes and servers in your apartment that make a lot of noise.

It's not end to end encryption or zero knowledge tools. It's not um, you know, completely hiding or going off the grid. And, you know, there's um, actually a giant book um, I forgot the writer, but it's how to go off the grid completely. And it's so big because it's that complicated to do. And then um, using Monero, for example.

No, the pro h sorry I thought the prophecy of my slides not working came came true. Um what you should also think about when you think of privacy is simple tools. It's simple little things. So for example downloading signal instead of WhatsApp and using that when um when Apple asks you if the app can track your activity always be sure to press ask app not to track. It's a simple button but it does help.

It's uh events. It's uh you know like little things to obscure um obfiscate yourself from security cameras because as we know in the UK there's a huge uh problem with facial recognition in surveillance uh car uh cameras. They actually run a program in Cardiff and uh not enough people are complaining about it because honestly it's not great because surveillance could be about safety. So one of the things that you might think of is like but how do we catch the criminals? But then when you also think of surveillance, you always need to think of two ways.

So who has that surveillance because it is power and who is a criminal because the person or like you know the state that has the power will determine what is criminal and what is not. So if they want to [ __ ] someone over it doesn't matter. They will find a way because they establish the rules. So this is why um offuscation and cippher punk methods where you can fight this by yourself through code or through little collective things like that like you know a great example is actually masks. So before COVID masks were not very popularized like there they weren't even like fabric masks they were only medical masks and um I think I was wearing one a month before the whole global epidemic started and everyone was freaking out.

They were looking at me and like stepping away from me being like, "Jesus [ __ ] Christ, like this woman is sick." And then now if you wear a mask outside, nobody cares. They're like, "Oh, she probably has a flu." And the more normal we make things, the more acceptable they are. And in the end, it becomes collective care because for you, you might not care that much.

But for example, for me, I'm I'm Russian and um I travel to Russia and when I'm there as a privacy activist, um I don't feel necessarily comfortable uh using WhatsApp and as my co-workers agree to use Signal, it's really hard to on board my non-web3 friends because they're like, why would I download Signal? Like it it doesn't matter. And then if I'm there and I'm the only person on Signal, it's an echo chamber. But um if um if all of my friends move there, it's not just a privacy activism, it's collective care. It's care for me because for them it's just an app but for me at that moment it's you know my my safety and it goes not just for signal versus telegram sorry or telegram as well um but in general for example normalizing things like um something women in private privacy did at um at in Berlin is actually this installation uh with a couple of people in a picture where we created those masks so people can take anonymous profile pictures so they don't have their eyes in it, but it looks cool.

And something that like this should become normal, like maybe having photo booths at conferences that can allow you to obscure like, you know, obiscate your face in a fun creative way. And also something that most people don't know is that it's not very good to keep the same profile picture. Although I do that, too, but uh it's not very good to keep the same profile picture for multiple different accounts at the same time because AI can track you much better and, you know, kind of like put together your actions much faster. So, the more diverse profile pictures you have, the better. And having things like that will actually encourage you rather than going on Pinterest and searching for a weird obscure mushroom to put as your profile pick.

And um yeah, creating very simple privacy toolkits. So, having you know um if my friends say, "Oh, okay. Like, uh WhatsApp introduced this uh AI feature and that freaked me out. What can I do about my privacy?" I want to have a one pager to send to them that will not include, oh, you should install this ZK knowledge proof, uh, you know, app that doesn't even exist yet and it only runs on this specific test net.

I want actual, you know, uh, physical little things that I can do to make my life easier and, you know, make my life a bit more private, not necessarily for me, but also for people that I interact with because privacy is collective care. And please do it with style because aesthetics are a big thing. And if something is aesthetic and easy to use, we all will fall for that. And then uh the bottom pictures are from web three privacy now events. So as you can see, a bit of obuscation with film camera and um hiding faces uh just community and talking about it.

So for everyone here who was at the web privacy now event yesterday, it was very chill, relaxed. It wasn't like sit down and now we're going to talk about this complicated cryptography that only one or two people in the audience will understand. No, it was chill. Like let's talk about GDPR but make it fun. And um making privacy more of a collective fun thing to do.

So when you think of privacy, you might think of, you know, a nice party. You might think of good beer. You might think of good snacks. If you ever been to Rome and tried a trapino, good snacks for sure. And yeah, so where do pants come in?

So the movie that I mentioned before about traveling pants, um, I see it as a metaphor and it might not be the perfect metaphor, but it was the first metaphor I could think of. And, uh, metaphor for privacy being collective, for privacy that's, you know, um, a metaphor for the pants that united this friendship and gave them, you know, a a story being like, oh, like I'm going through a breakup in this city and, uh, I just lost my job and everything's horrible. Oh, here you should have the pants and like you know they wear them for a year and then somebody else is like oh but I'm I'm running off with a stranger to to you know to Mayor Yorkca and it's going to be like a crazy holiday for me and then the pants also experience that and adapt to you know different environments and privacy should be the same. It should be collective. It should be shared in stories shared in human language not just end to end encryption.

I mean human language that preferably online would be to end encrypted but not just as a you know very techy very kind of gpp gatekept way that my friends wouldn't understand like I think they would understand this talk but some talks I just uh they're very relevant for this specific conference but I do want more events around to bring in more newcomers that wouldn't be scared of privacy just because it talks about you know zka VMs too much and uh privacy can adapt and mix. So, for example, you know, like activists uh put their phones in a freezer sometimes to avoid being tracked and uh you know, you can take that tip and then you can you can research it and then maybe I don't know um find a better way to turn off your location services or just not bring your phone to the protest and um yeah, like you can you can get imaginative. So it's also a ritual in a way that for example in um web three privacy now hackathon we had balaclava merch and uh it was a bit weird to be honest to see people walking around with wearing a full-on balaclava because that's not something you would see on the street. If you would see that on the street you would be like what is happening? But just normalizing it in style and making it cool and fun and associating these things with good things rather than oh that's a criminal who's hiding their face could actually benefit the society as a whole and um yeah more communities not just protocols because um at this stage of web 3 I think we do have enough infrastructure there should be more and there are so many things being developed but we should expand in a way that also invites non nontechnical people into this so having a bit more ecosystem diversity having a bit of people that care about tech and privacy but also you know having no web 3 background.

So inviting doctors, inviting veterinarians, inviting anyone who like truck drivers uh to these kind of events and cater like creating content also for them because then we can actually get back and forth and feedback from would they use this product? Does this seem crazy? Because if if you've been bubbling like in this in this web three soup long enough, you lose touch like you you lose sense of what is real world at some point and I've seen that happen way too many times. So why web3 privacy now and women in privacy? So what we do is we take the privacy out of the echo chamber.

So we throw events in very random locations. We we always go you know very um anti- like you know anti- yatsuh in Dubai and we during big events like for example ECC last year or ECC this year we host occupy so this year for example at ECC we're going to have uh web3 privacy now occupy which is where we're literally going to squat in the park and then everybody like there's zero budget actually maybe some budget for some beers but then if somebody wants to sponsor they can just provide beers for people they can just bring some food. Um, you know, it's a collective thing and people bring in their different talents and their different interests. So, somebody would bring tarot cards or somebody will bring um, you know, um, some some artistic talent, maybe do some impersonation and some people like people talk about privacy in a much chiller way. So, no recordings, no uh, mics, things like that.

So, actually fun and chill events for community because it feels more like a party rather than a conference. And uh that's where privacy should go into because we've had enough conferences we need to expand into more partying. So yeah, I'm actually here to um to promote partying, but um also ecosystem diversity like I mentioned before, normalizing talking and showing up in privacy. So normalize being like, "Yeah, I'm on Signal." And I mean, yeah, a couple years ago I, you know, drug dealers use Signal and a lot of people found out about it through that.

And um I don't know those dealers at all, but um it's uh yeah, just normalizing it away from criminal context and more into collective care. Like we need to make it cool. We need to make it something that people want to wear. Like you know, fashion brands, they have so much [ __ ] ugly stuff, but people want to buy it because they want to be part of this, you know, persona. They want to be part of this brand.

And we need to make privacy this cool effervescent brand that you know shows that you care for humanity, you care for your friends and yourself and the future. So yeah, aesthetics and narrative please more aesthetic merch. Uh like it we we need more than just t-shirts and then promoting public goods. So just like on a panel pre previously something that will bring more attention into that entire you know line of funding. So instead of donating to a charity uh you can go for public foods uh public foods public goods where it gets distributed between different channels and for uh projects and safe events initiative from women in privacy like I mentioned before integration on top of the events and um yeah privacy should be collective care because it's not about you anymore it's about your friends and I think that might be the best uh you know call to action that people can have because most people are like, "Oh, but I have nothing to hide."

But your friends might and it might be, you know, not something that is u you know actually bad. It could literally just be that they're queer and they're traveling to Turkey or that you know they're in an abusive relationship and they want to escape but also don't want to be tracked on a you know family plan of tracking locations and you know it's uh it's for again your trans friend that is traveling somewhere to a not so nice country. There's just so many ways that privacy can benefit someone that you know. So, in the end, it's not about you anymore. It's collective.

And um that's about it. We have time to question.

Don't worry, Alina. We have time for plenty of questions. And thank you for reminding us that privacy is personal, just not technical.

Yes,

privacy should be less technical. So, please devs do something. Make it more accessible. We know everything that Europe is doing right now. They're trying to we have the privacy laws and then they're trying to make everything public on the side as well.

Yeah.

Don't don't get me started on the EU right now.

Don't worry, we can start on a qu one question we got in. So, who wins in the end of privacy and or convenience?

Who um it should be both. Privacy should be more convenient because when we talk about convenience, this is something me and a friend of mine talked about this morning actually on a podcast that a little Yapper podcast that we did. Convenience can [ __ ] you over in the long term. So for example with decentralized storage you have um you know storage on blockchain which is a bit more or less convenient but if you store all of your stuff on Dropbox um it can be also deleted or you can lose access to it and it's not convenient anymore and also you know it's uh if you're in a wrong state or wrong country at the wrong time you might be flagged as a criminal person for doing something that would be totally normal in your country and um yeah they would have access to all of your data. So in the or revoke your access to data and in the end convenience is a very tricky word because I feel like when we talk about convenience as just people not knowing enough or not being well aware of what using you know centralized apps and centralized systems can do to you that it can [ __ ] you over so easily and you don't even know it and we're not going to realize until it starts happening to a friend or a friend and then to a friend and then to you.

So education is also at the core of it. So that's why I'm like privacy versus convenience. Uh no, it's privacy versus educated guess. Not sorry, not the guest, but educated uh format.

Education.

It's it's like the Norwegian stu student that went to America now, had a meme on his phone, basically got out of the country now.

Yeah. Well,

because of a meme.

Good that it was just out of the country. It could have been worse. Could have been to a different country like El Salvador.

Oh, yeah. I heard a lot of that on there now. So, as we only have one up here, as love privacy, we have a guy in the back with a hands up. Oh,

bring it on.

I I like to keep human contact. I think it's important. Um, so I'm I'm asking the question like like this. Thanks first for the for the presentation, presenting something that serious in such a such an accessible way. Uh, my question would be how we reconcile two echo chambers.

one that is government that sees crypto and blockchain as something shady and with huge potential uh criminal with this echo chamber that speaks about privacy just in terms of protecting people from uh their ident for their identity or or things which I completely agree with. I'm part of the two echo chambers as a blockchain crypto enthusiast and as as part of my job that concerns mainly engaging uh with with governments. Uh and before answering I just want to underline that the security on the part I mean the fact that we are today here in this room without any risk of the of a of a terrorist attack it's a fantastic thing that doesn't come uh just like just like that. I I I happens to live in a country where if I'm going out on the street walking, it's a very high risk to get to get kidnapped. Uh so in Europe, we I know that we take this kind of security things like for granted.

But how do we reconcile to echo chambers to keep our security but also to keep the privacy that we we speak about in web three?

Well, when there's an answer to that, let me know. Would be good. No, but I think there's uh there's two ways to go around it. There's well not two ways to go around it. There's two approaches to you know finding this this balance because it requires not just a you know bunch of cipher punks in the in the room and you know it requires cipher punks in this room to be together with the people from the government that actually have the ability to make changes.

So there's two ways you can uh first one is education. So spreading education and that is collective action. So actually there's not two ways just one way. So collective action, education through events, education through, you know, posting memes about privacy, about normalizing kind of these kind of things so that the government also picks up because when we talk about the government, we feel like especially in a cipher punk echo chamber, it feels like this one big monster or like one big bad thing. But in reality, they're also people and they also have no idea what the [ __ ] we're doing.

like we're we're all lost in the space and um like actually just on the planet floating through space. But um getting through to them through you know um regulation amendments through organizing events through um you know maybe hosting educative panels for them and uh providing this kind of education that they don't have because they're not boiling in the same soup as us and um also educating the public. But if you think about it, like a person who's making the key decision, they're just like us. They're probably scrolling through Instagram as well, like reals while either on the toilet or before going to sleep. So if they start seeing a bit more privacy content, if they start seeing a bit more even like fashion content on balaclavas or face obiscation, it might become more normal to them subconsciously that people want privacy and they will maybe remember and learn that privacy is a human right.

And um the in the last century the you know the governments have been going a little too far to sacrifice uh privacy for security but as we all know um a lot of it is not really in the name of security. A lot of it is decided by the government what they consider security or not and um yeah we're just uh privacy is power and we shouldn't give out all the power to the government but we also should together find this middle ground that will be there. I I hope this answers the questions because uh yeah when you find out the answer to this the balance uh um please call me. Yeah, I saw meanwhile there came a very enthusiastic consensus builder in how about chat tpt and similar. Do you worry about the data shared there?

It is it seems inevitable.

It's not inevitable. It's just education because there's private local LLMs that you can run on your laptop. Um I'm yet I'm yet to find an app that will be on seamless UX design on my phone that I can use. But there are alternatives. they're just usually open source open um you know public goods because it's not very profitable because the way that open AI for example profits is by selling your data and it [ __ ] you over easily because for example insurance companies can buy it and then you know target you specifically or increase rates for you and that's just a very chill and easy example of how your data might be misused with Chad GPT but that's a profitable model the good products don't have that profitable model so they're not very easily funded so you're not going to get a perfect app on your phone.

But what you can do is use the shitty apps and give them users, give them traffic. When you see a bug, report it. Help this project yourself as well. And I know that it might be a bit inconvenient, but it's also going to be good for, you know, humanity and your privacy and your friends privacy.