(bright music)
- A man checks his smartwatch. - Our modern,
digital lives offer limitless convenience, community,
and easy to access everything.
- [Speaker] The internet opens unbelievable opportunities.
- [Host] But there's a trade-off. Your personal data.
- [Speaker] Pretty much everything you do on the web
is being tracked and logged.
- Who you are, what you're doing, and where you're going.
- This is the mothership.
Can you show me what I've inadvertently given up?
And that personal data is worth a fortune.
- People expect it to grow to $400 billion.
- To completely avoid data collection
requires you to go live in a cave.
- [Host] Thankfully, there are tools
to help maintain your privacy and security online.
- Let's create some strong and unique passwords.
- Everything has privacy settings.
We can dial to whatever level we feel comfortable.
- [Host] And some coders are rewriting the rules of the web.
- The decentralized web is our antidote
to the web as we now think of it.
- New technologies can proliferate
without centralized control.
- This is about technological self-determination.
- [Host] Secrets in your Data right now on "NOVA."
(triumphant upbeat music)
(phone camera clicking)
PATEL: Our world runs on data.
When you're shopping online,
streaming your favorite shows...
(mouse clicking)
posting family pics--
that's all your personal data
leaving your device.
(on phone): What's up, everyone?
I'm about to head to the hospital
for a night shift...
(voiceover): I'm Alok Patel, a pediatrician,
medical journalist,
and all-around social media enthusiast.
(on phone): Just got here at the children's hospital...
(voiceover): I kinda love our connected lives,
and I haven't been shy at all
about sharing mine pretty publicly.
(on phone): 30 million children...
(voiceover): And I know that sharing personal data
can have major upsides.
The media's reported
on some of the most dramatic examples.
NARRATOR (archival): ...is conducting several studies
to see how far wearables can go in detecting disease.
A California man, rescued yesterday
after going missing credits a social media post
for helping save his life.
Six out of ten people with Alzheimer's or dementia
will wander away from home,
and that's where this little box comes in.
PATEL: There's no doubt, our data is out there,
but did you ever wonder where it goes
and how it's used?
I do.
I want to know: what are the benefits of sharing
and the risks?
And what can we do to make our connected world safer
and just generally better for everyone?
First, the basics.
I want to know:
how much personal data have I been sharing?
Meet Hayley Tsukayama, tech journalist
and data privacy advocate.
(chuckles) PATEL: You must be Hayley.
Hi, nice to meet you.
What is going on?
(voiceover): Okay, hold on, wasn't expecting this.
She's already got my whole life up on the screen.
So this is a data report gathered about you
from social media posts,
from the images of you that may be on the internet,
from publicly available information.
This is like a family business.
That's my dad's cell phone number.
Why is this available?
(groaning): Oh, this is my address!
This is just available?
Just available online.
Okay, you guys are going to
blur all this, right? Please?
There's-- oh, okay, cool, there's my cell phone number.
Oh, this is concerning.
As a medical doctor,
we all have license numbers
and issue dates and expiration dates.
(chuckling): And it's literally right here.
This is so weird,
these are the names of my neighbors
from my childhood home.
(whispering): Why do you have this information?
Like, I haven't seen these names in...
years.
(voiceover): Not gonna lie,
I expected some of my data to be out there,
but this is...
this is just creepy.
How is there a report
about who my neighbors were in the '80s?
LEVY: You can be assured that pretty much
everything you do on the web
and with a browser
is being tracked and logged.
Where you go, what you look at,
what apps you use.
SAFIYA NOBLE: Modern life has been arranged
so that every aspect of
what we do and how we live can be captured.
MEREDITH WHITTAKER: They pick up our faces as we walk down the street.
They track our keystrokes while we're at work
on behalf of our employer.
(keys clacking)
GALPERIN: And ad networks use a bunch of
creepy and nefarious ways of figuring out
who you are, what you're doing, and where you're going.
PATEL: What happened to the web I grew up with?
♪ ♪
I came of age when the internet was a fun and weird party,
and everyone was invited.
Remember GeoCities,
AOL Instant Messenger,
or the dancing "ooga chacka, ooga chacka" baby?
♪ ♪
Today, it's clear that innocence is gone.
Is the party over?
To understand the present, I want a refresher on the past.
(machinery whirring)
So I'm visiting the Computer History Museum
in Silicon Valley.
(video game music, Patel chuckling)
MARC WEBER: Okay, I'm headed straight for the sun...
PATEL: I'm meeting computer historian Marc Weber.
What a maneuver! There's a straight line
of bullets coming right at you--
(exploding sound effect, Patel groans)
(voiceover): ...Who just wasted me
in the cosmic battlefield of "Space War,"
one of the first video games.
(laughing) This is actually really fun.
♪ ♪
This is cool.
ICBM computer from a nuclear missile.
Woah.
Human-computer interaction.
PATEL: Now, this looks fascinating.
I can't tell if this is like,
this universal clock apparatus,
or what's happening here?
This is the first punch card machine.
And this was an invention
to make the U.S. census faster.
PATEL (voiceover): It's kind of wild,
but the dawn of automated personal data collection
looks like this--
census info poked into humble little punch cards.
Marc, can you explain punch cards to me?
Because when I think punch cards,
I'm thinking lottery tickets,
or "buy nine cups of coffee, and your tenth is free."
Well, it was the first way to record machine-readable data.
PATEL: Okay, let's make sense of the census.
This kind of data collection
has been going on for centuries.
But starting in 1890,
data was recorded in a pattern of holes
"punched" into a census card.
So the cards were used to collect census data.
What exact questions were on there?
So things like age, gender, number of children.
PATEL: When a card passes through the machine,
the holes allow pins to make electrical connections
through the card.
A counter keeps a running tally
in each census category
as more cards pass through.
Census data is how the government
allocates resources for schools and hospitals;
draws the lines for districts;
and decides how many representatives
each state will send to congress.
It's a reminder of the value of collecting data,
but it's a far cry from
having my every move tracked on the internet.
To help connect the dots,
Marc shows me the next surprising step
in the evolution of data collection.
♪ ♪
I look at this and I'm almost like,
"Oh, this looks like a modern office building to me."
WEBER: Exactly. Each one of those
is one of these giant terminals here.
(static hissing)
PATEL: During the Cold War,
IBM figured out how to hook up computers
from all across the country to monitor
U.S. airspace in real-time.
(rocket blasting off)
So, this is a terminal from SAGE.
(beeping, static)
PATEL: It was the first real-time networked data system.
Real-time is just that:
instantaneous.
And "networked" means connected.
Computers from all across the country
were hooked up to each other,
so they could share data in real time,
Sort of like the internet.
WEBER: The whole point was to track incoming Soviet bombers,
and they built, arguably,
the first computer network in the world.
PATEL: IBM soon realized
that their aircraft-tracking computers
could be used commercially.
♪ ♪
So In 1960, along came SABRE.
(beeping, static)
A real-time networked data system
that shared personal data.
WEBER: The story goes that
the head of American Airlines met with IBM,
and they decided to do a partnership,
the key idea being real time.
They could look at your age, your name,
financial information,
what flights you'd been on before,
your dietary preferences for your meal,
all of this right then in real time.
PATEL: We went from tracking bombs to
tracking butts on planes.
WEBER: Exactly.
PATEL (voiceover): Between "Pong," punch cards,
and planes... Whoa, whoa, whoa!
PATEL (voiceover): I could see how data started connecting the world--
the military to our airspace
and companies to their customers.
But what if those customers all over the world
were linked up to each other?
What would we even call that?
Oh yeah, the World Wide Web.
PRESENTER: The World Wide Web is a part of our lives
and getting bigger every day.
But what about the man who dreamt it all up?
PATEL: News reports opened our eyes
to this innovation and its creator,
Tim Berners-Lee.
PRESENTER: He simply wanted
to give it away for the benefit of others.
TIM BERNERS-LEE: When the web started,
anybody could make a website.
You could make your own style,
your own poems, your own blogs,
and you could link to other people.
The feeling and the sense was of tremendous empowerment.
(modem dialing up)
NOBLE: Some of us remember the internet
when it was managed and curated by people.
Where it was, you know,
bulletin board systems and chat rooms.
♪ ♪
PATEL: In the late '90s, small start-ups
were maturing into big tech companies--
with lots of users and user data.
KAHLE: As the web grew,
we ended up with a very few companies
going and doing all of the hosting.
It wasn't your actual personal computer doing it.
NOBLE: The large platforms that have emerged are dependent
upon user-generated content
and user engagement.
The modern internet is a wholly commercial kind of internet.
PATEL: And as web traffic started to flow more and more
through just a few companies,
they began to realize the value of all this personal data
piling up on their servers.
ALEKSANDRA KOROLOVA: Google started to understand
the power of individual's data.
They have information about
not just how the websites
are interconnected,
but also information about the individuals.
HILL: The big technology companies.
They're looking at where you are,
They're wanting to know what your gender is,
what your age is,
you know, how much you have to spend,
what your political beliefs are.
They have a lot of power to determine
what our privacy is.
RASKAR: That's trillions of dollars
of economic value that's out there,
and there's a constant struggle
between who owns the data.
We create the data,
but somebody else monetizes it.
PATEL: As big tech was maturing,
early data collection on websites was pretty limited.
So what happened to supercharge it?
To create the vast tracking infrastructure
that allowed Hayley to find out so much about me?
It turns out things really got going
when someone invented...
Cookies?
A cookie is not actually a tasty snack.
When you go to a website,
the website sends
a small file to your browser.
(keys clacking)
PATEL: That small file allows the websites
to collect information about your visit,
and update it every time you come back.
You might have heard of cookies
because a lot of websites
pop up with messages prompting you
to accept theirs.
But what happens after you hit "accept"?
GALPERIN: It then uses cookies
to track who you are and what you're doing,
including in many cases,
all of the other websites that you go to.
RUMMAN CHOWDHURY: Cookies have the cutest name,
but they're actually a really important
piece of information about you.
Every time you click on a menu,
every time you look at an item
or put it in your cart,
every time you want to buy something
and click out of the website and come back in.
A cookie is what's enabling you to do that.
It's a piece of tracking information.
You can impute data and information about you
from the seemingly innocent behavior online
that's tracked via cookies.
Do you have certain lifestyle conditions?
What age are you?
What gender or race are you?
Do you have children?
PATEL: Okay, so I'm starting to get
that these tech companies
use things like cookies to keep track of
what sites I'm on, what I'm shopping for,
and what I'm watching.
♪ ♪
(doorbell chimes)
But do they have other ways
of learning the secrets in my data?
To learn more,
I'm tracking down a data security expert
in his hacking high-tech superhero lair...
naturally.
(door rolling open)
Are you Patrick Jackson? My name's Alok.
Yes, I am.
Awesome, I'm in the right place.
(door rolls shut)
Your phone is sending this extra data
to these people that
you don't know exist.
PATEL: Patrick Jackson has been
all over the news for his work as
a former NSA research scientist,
and is now chief tech officer
for the internet security firm Disconnect.
And if anyone can help me
understand how my personal data is leaking,
it's him.
Patrick, when I think about
the main control of my work, life, play,
what I'm doing at home, when I'm on the road,
this is the mothership.
If I were to relinquish control
of this precious device for a few moments,
can you show me, like,
what I've inadvertently given up?
Yes, yeah.
I can show you what these data companies
know about you and what they're collecting.
PATEL (voiceover): Using a hacking technique
called a "man-in-the-middle attack,"
Patrick can intercept the personal data
that's leaving my device,
essentially eavesdropping on a conversation
between me and the websites
and applications I use.
JACKSON: Contact information,
name, phone number, email address.
When you agree to allow them to have your location,
I can see not only where you're at on a map,
but also where you're at in your house,
whether you're at the back of the house
or the front of the house.
When you look at the data
leaving the phone, every time you open an app,
you send about, maybe,
500 kilobytes of data to their servers.
That is equivalent to about 125 pages of text
that you would print in a printer.
PATEL (voiceover): It's one thing if the apps on my phone are collecting data,
I chose to download them.
But Patrick says that other companies
have even sneakier ways to get my data.
Like something as harmless
as a marketing email.
To demonstrate, Patrick sends me
a mock promotional email.
I have an email that says
"Shoe Sale."
It says "open to view the shoe sale,"
and I want to open it, so I'm going to.
"Hi, Alok, get ready for upcoming shoe sale."
I like this graphic, and there's like,
social media icons. This looks legit.
(voiceover): It turns out,
emails can include a tracking pixel--
also known as a spy or invisible pixel.
JACKSON: An invisible pixel is a type of image
you're never intended to see,
but it still initiates a handshake of data
from your device to these data companies.
(keys clacking)
Most of the emails that you receive
likely have these tracking pixels in them.
Most? Most.
This invisible pixel is actually
disguised as the banner
in that email.
In other cases, the tracking pixel will be a one-pixel,
very, very tiny image
that you would never see with your eyes,
and it's not meant to be seen.
(zooming in)
PATEL: That little pixel, that little spy.
See it? Right there.
It can hide in images embedded in an email,
like a banner, or even an "unsubscribe" button.
And when you open the email,
it contacts a tracking website to collect data about you.
It can suck up your device model,
location, and even some browsing history.
JACKSON: This is essentially a digital fingerprint
of your device. PATEL: No!
JACKSON: That fingerprint would identify you as who you are,
and somebody else in the future
could look at that fingerprint,
make you do a new fingerprint,
and they would know that this is the same person.
PATEL: Companies are snatching copies of my digital fingerprints
wherever I go online.
And by following that trail...
JACKSON: Companies are, over time,
collecting everything about you.
That's how they build up this,
this digital profile about you.
HILL: The internet is this data collection machine,
and as we're moving through the internet,
there are these companies
whose whole job is
to reassemble that trail.
PATEL: So now I know how my digital profile is out there,
but why?
Who really cares that
I take pictures doing handstands
and own way too many sneakers?
Turns out, there's a whole industry
devoted to selling my data.
It's the data brokers.
♪ ♪
Data brokers are companies that are set up to
collect information, repackage it,
and resell it or re-share it
to other companies that may want to know
information about you.
So what do data brokers want with all our personal data?
Why do they care that I love chicken mole
and that "Cool Runnings"
is in my top five movies of all-time?
TSUKAYAMA: They collect all this information,
and then they're really trying to slice and dice it
in ways that are appealing to customers.
You know, it could be an employer
who's doing research on you,
it could be a retailer who wants to know
what kind of customers they can target with ads.
That kind of information
is really valuable for advertisers,
because they want to target advertising
to a certain type of person.
PATEL: Our data ends up eventually getting compiled
into reports like these,
that are then sold to...
whoever's interested?
TSUKAYAMA: Data brokers are able to say,
"Look, we have a group of people
"that will fit the audience of your product.
"We really are happy to serve this list of people to you,"
or to make a score about how likely they might be
to purchase your product.
Okay, I know people say
"Oh, your phones aren't listening to you,"
but we were just talking about retro video games,
and here is an ad for
home mini-arcade machines--
which looks kind of cool-- but how did it know
we were just talking about that?
Is my phone listening?
Is it a psychic?
What's happening?
People always say,
"I was talking about this product,
and then I saw an ad for it.
"Matt, are they listening through my phone?"
And I'm like, "Well, they didn't hear you,
they didn't listen to anything."
The truth is actually more frightening.
You talked about that thing
because they influenced you
into having this conversation.
It's because the algorithm took you to this place.
And that's the situation with our data.
PATEL: There have been some outlier examples
of ad tech companies listening without consent,
but that's against the law.
For the most part, advertising algorithms
know you so well that they can predict
what you would find interesting.
They are so good because they've studied
all the data gathered about you--
from the data brokers.
There's this kind of dossier
that's being created about you
as you're wandering around the internet,
and it's being used to,
you know, decide what ad you see.
PATEL: Advertising fuels the economics of the internet.
And advertising is fueled by
you, me, us--
our personal data.
So how do the algorithms actually work?
You land on a webpage,
and that webpage
gets your I.P. address.
A unique identifier is returned to a data broker.
That data broker
looks up all the facts
that were ever gleaned about you.
A dossier that describes you.
PATEL: And then advertisers literally bid,
they bid on you, in a real-time auction
based on the only lesson I remember
from Econ 101: supply and demand.
DOCTOROW: The demand-side platform
that the advertiser is on says, "I have here
"an 18- to 34-year-old man-child
"with an Xbox in Southern California.
"Who wants to pay to cram something
nonconsensually into his eyeballs?"
And that takes place in a marketplace,
and you have advertisers on the other side
who have standing orders.
They're like, "I want to advertise to
"18- to 34-year-old man-children in Southern California
who own Xboxes,"
and the marketplace conducts
an automated high-speed auction where it's just like,
"I'll pay so many fractions of a cent,"
"I'll pay that plus ten percent."
(auction bell rings)
The high bidder gets to show you an ad.
PATEL: All of this happens nearly instantly.
And it's possible because data brokers
sort and cull personal data
into super detailed consumer groups.
This is the process that delivers
relevant personalized ads
for cute shoes
or that new tea club--
if you're into that sort of thing--
which all the ads seem to know about you.
TSUKAYAMA: Here we have, for example, Soccer Mom.
PATEL: Okay.
I might be able to identify with that.
A sporting goods retailer could then go and check out a file
on what a Soccer Mom's online activity is like.
TSUKAYAMA: What are the things that they tend to spend money on,
and do they like to save?
Are there certain times of year
where they might spend more or less?
PATEL: With all this data about Soccer Mom's consumer habits,
retailers can send personalized ads with uncanny timing.
Some people like the results-- soccer moms get deals.
Advertisers keep websites we love in business.
But...
some consumer categories can be more concerning.
HILL: Sometimes they'll have categories
that are like,
"This person has erectile dysfunction,
"this person has a gambling problem.
"This is a list of, kind of,
people that are likely to fall for frauds."
So these can be really powerful and damaging lists.
TSUKAYAMA: So this one, for example,
diabetes. PATEL: Wow.
Okay, healthcare demographic...
The thing about that, right, is like,
when you're thinking particularly about health data,
that indicates that you're probably
in a pretty sensitive situation.
PATEL: I'm now thinking about all the patients I take care of.
And I shudder to think
at the targeted ads that are
deliberately targeting these individuals.
(keys clacking)
TSUKAYAMA: Data brokers have lists about sexual assault victims,
they have lists about dementia sufferers.
Those are some really concerning types of categories,
and you could definitely see how
an advertising company could take advantage
of people on those lists.
So I think a lot of people's first reaction
on seeing these data broker reports
is like, where has all of this come from?
There are a lot of places where data brokers get information.
Most commonly apps that
you download that have deals
with data brokers to share information.
PATEL: All right, I knew that apps were getting my data,
but I had no idea some were sharing it with data brokers.
How is that even legal?
TSUKAYAMA: How often have you seen a terms and conditions screen
just like this?
All the time. Anytime I download
anything, basically. (both chuckle)
I download apps all the time
for work, play, life, convenience.
I just scroll all the way down and hit accept.
because I'm over it. Right.
And I think that's how
most people feel about it.
PATEL: "By accepting these terms,
you allow the platform to freely..."
"...content for demonstration, promotion, and..."
TSUKAYAMA: Terms and conditions are really long.
Cool, I'm in a commercial
and don't even know about it.
TSUKAYAMA: Carnegie Mellon once did a study that said it would take
days for somebody to get through all of the terms and conditions.
They actually use the word exploiting.
"You represent and warrant..."
TSUKAYAMA: That puts people in a really difficult position
when we're supposed to manage our own privacy,
but we're also supposed to use all these things
that are products that will make our lives better.
(papers rustling, teacup clatters)
Data brokers are a big industry.
It's about a $200 billion industry right now.
I think a lot of people expect it to grow to,
you know, $400 billion in the next few years.
NOBLE: That level of data from our past,
all the things we've done being used
and put into systems
to help predict our futures,
that's unprecedented,
and that's rife with the potential for discrimination,
for harm, for exclusion.
PATEL: Okay, I know I said
that I'm not the type to log in to...
(voiceover): Look, I love being online.
I like sharing what I'm up to on social media,
and I'm not afraid to share my thoughts.
Okay, bugs, I don't bite you,
you don't bite me.
It's that easy.
But some of this personal data
is, well, personal.
So, now I need to know:
What can I do to make my digital life
more private and secure?
GALPERIN: Privacy and security are not the same thing.
For example, uh,
Facebook is extremely interested
in protecting your security.
They want to make sure that it is always you
logging in to your account.
They will go through a great deal of trouble
to keep your account secure.
But you enter all kinds of data into that account.
You tell it where you are located.
You send it all of your pictures.
You send messages
and Facebook collects all of that data.
They don't want you to keep it private.
They want you to hand it to them so that they can use it in order
to serve you targeted ads and make them money.
PATEL (voiceover): My accounts are mostly secure
when I control access to them.
But that doesn't mean the data I put in them
stays private, far from it.
Privacy and security are not the same.
But they are two sides of the same coin,
and I have to understand both
if I'm gonna protect
my personal data.
MITCHELL: When your privacy is taken from you,
your agency is taken from you.
Privacy is that whisper.
When you think you're whispering to your friend,
but you're shouting in a crowded elevator,
you're robbed of something.
And that's why privacy is so important.
PATEL: What can I do right now to protect my privacy
and my security?
To learn tips and tools to preserve my data on both fronts,
I'm chatting with hacker and educator Matt Mitchell
and cybersecurity expert Eva Galperin.
First up: privacy.
Sorry.
(whispering): Privacy.
Matt is a privacy advocate
at CryptoHarlem, as in cryptography,
the process of hiding or coding information.
Hey. I'm Matt. Thanks for coming to CryptoHarlem.
MITCHELL (voiceover): CryptoHarlem is anti-surveillance workshops
for the Black community
and all marginalized communities around the world.
And our mission is to develop people's digital skills
so they can actually help us in the fight
to push back on digital harms.
MITCHELL: Privacy is not secrecy.
Privacy is just a door.
A door in your home.
There's a sense of, like,
I want to control what can be seen,
what can't be seen just for me.
PATEL (voiceover): And I want to close that door.
So how do I do this?
Even just a little?
PATEL: Okay, what do I do
to make all this safer for me?
What do I do, who do I talk to, how do I start?
You have to ask yourself,
"Is this a problem that needs to be fixed?"
Privacy isn't a switch.
It's a dial.
You get to control how much you share
with who and with what.
PATEL (voiceover): Let's start with a big one,
something I use all the time, every day,
and I bet you do, too.
Have you ever used this website called Google?
I've heard of it. Yeah.
Well, let's check this out.
Well, if we go here
to myactivity.google.com...
...it'll show us all the things that you've been doing.
So for example,
when we go here,
we see all the different Google services that you use.
I don't think they make a service you don't use.
PATEL (voiceover): These platforms are so deeply embedded in many of our lives
and for good reason.
They make products that can be really useful.
It's hard for me to imagine
going a single day without searching the web
or using a navigation app.
But they also suck up a lot of our data.
It's a trade-off that I'm comfortable making,
within reason.
I've used literally everything Google has ever offered.
And it knows what you've used.
And it records everything you've ever used
and how you've used it.
Every search term you've used,
every, uh, you know, shopping item you've used.
But this is the dashboard to delete it.
PATEL (voiceover): I didn't know this, but I can literally just delete
huge amounts of data that Google is storing about me.
And the same is true for a lot of other services.
We can dial to whatever level we feel comfortable.
For example, on LinkedIn,
you would just click on me,
and then you would go to your settings and privacy.
Here, when we go to manage your activity,
it tells you that, you know,
you started sharing your LinkedIn data
with a permitted application.
PATEL (voiceover): Treating privacy like a dial means it's not all or nothing.
You can have your data cake and eat it, too.
Like now I'm thinking I want to log into everything--
all my social media, my email, my LinkedIn, everything--
regularly and look to see who is using these.
Exactly, it is about awareness.
Furthermore, the companies,
they know how many people actually use
the privacy controls.
And by you even peeking in it,
you're saying I believe privacy matters.
At the Electronic Frontier Foundation,
Eva shows me how I can take my privacy game
to the next level...
learning some Surveillance Self-Defense.
Although, apparently not that kind of self-defense.
GALPERIN: So, the next step in your privacy journey
is fighting back against
types of corporate surveillance.
I-- and one of the things
that websites really like to do when, uh,
is not just to track what you are doing on their website,
but to track all the other websites that you go to.
And they do this using cookies.
There's some companies I trust,
and I'm like, fine, you have these cookies.
They're chocolate chip. I know where they were made.
I know what you're doing with them.
But then there's these third party companies,
I don't want them around me.
You can use a browser extension
to eat these cookies, uh,
and fight back against this kind of tracking
and keep those websites from seeing where else you're going.
PATEL (voiceover): Browser extensions are add-ons for your web browser
that give it extra features and functionality,
like eating cookies.
I'm imagining this,
like, digital Cookie Monster that's eating up
all these pieces of my online activity
so that companies don't know what I'm doing online.
And it reduces the amount of privacy tracking.
Am I understanding that?
What these browser extensions
do is they get rid of, uh, the tracking cookies
that these websites use to see
all the other sites that you're going to,
which is none of their business.
(knuckles crack)
PATEL (voiceover): My personal digital world is starting to feel
comfy, controlled and a lot more private.
I've learned how to close the doors and blinds.
But still, someone could open them right back up.
I could get hacked.
How do I lock my doors?
Time to talk about security.
MITCHELL: The tragedy of
this recent pandemic teaches us
that we're all pretty vulnerable.
And without that herd immunity,
without that community response,
you can't just say, "I'm okay,
and therefore I don't have to worry about this."
This is the first time that I've ever heard
someone compare data privacy
to epidemiology and herd immunity.
All you need is one person to make a mistake
and it's game over.
That's what happens to so many other corporations, businesses,
even hospitals during a ransomware attack
that'll freeze all machines and stop them from working
until someone pays a bunch of hackers.
My one error could compromise the security
of my entire institution.
MITCHELL: Human beings will make mistakes.
Folks won't wash their hands sometimes, right?
But we try to teach best practices to prevent the worst.
Okay, Matt, you have my wheels spinning.
I do not want to be patient zero
in this, like, massive infectious data leak.
What can I do to start pulling it back
and better protecting my information?
Well, I got something for that, okay?
Oh, you have, like, a bag of tricks. I've got a bag.
I thought you were just gonna say, like, change your password.
We got to go all the way.
This is a privacy screen.
And this will keep people from being able
to look over your shoulder.
Shoulder surfers beware.
Can't look through that.
This is for like, using my computer
in a public space, the airplane.
Everywhere.
This is a Faraday bag.
You got to keep your phone in here.
This blocks RF signals.
It's basically aluminum foil... PATEL (voiceover): Yo, Matt?
Can we slow this down a little bit?
You can't get hacked when you're not attached to anything.
Is this really necessary, a Faraday bag?
PATEL (voiceover): Okay, this looks a little more complicated than I expected.
I guess I just have to become Dr. 007.
We also have a Wi-Fi pineapple.
This is a portable access point.
And we also could use it to detect
and stop access points from going bad.
PATEL (voiceover): Okay, Matt, now you've just gone rogue.
MITCHELL: Let's say you have a hard drive
with some important files from work in it.
What happens if you lose it?
Someone can plug that in and have access
to all your stuff.
Not if it's an encrypted hard drive.
I understand-- There's more.
How do you know that you're not being bugged?
This is nuts.
This is something I could use to find out
if there is a audio bug in the room. (beeping)
I can find Wi-Fi signals... (device beeps)
Oops, something's here, right?
PATEL (voiceover): Honestly, I thought being a spy would be more fun.
But I'm starting to feel shaken, not stirred.
How am I supposed to keep track of all this stuff?
I'm no hacker genius like Matt.
What if I just left all of this behind and just quit.
Goodbye, digital world.
(clock ticking)
(yawning)
Do you know if there's breaking news? (cat meows)
Look in my eyes and tell me.
What are we doing here?
What are we doing?
Like, I don't even know
how many steps I've taken today.
Because my step counter is not on my hand.
I'm technically disconnected, this isn't cheating,
but can someone tell me what the Suns score is?
CREW MEMBER: Uh, down by 11 at the half.
(groans)
(cat purring)
Oh, I am supposed to pick up my daughter.
How long do I have to do this for?
(voiceover): All right, maybe it's not that easy.
But there's got to be some middle ground
between Inspector Gadget and Fred Flintstone
that's right for me.
Instead of going completely off the grid,
I'm checking back in with Eva
for some more surveillance self-defense.
And the best place to start is with the basics: passwords.
I'll be honest,
my current password
is basically a combination
of my first pet's name plus my birthday
or a favorite video game or song.
I don't think any hacker's really gonna guess that.
But you're telling me that there is still a vulnerability there.
Yes.
Hackers can go find out information
about you from data brokers,
including, you know, the name of the street you grew up on
or the city where you went to college.
So you wouldn't want a password like the name of your pet.
Or password123.
Well, I did have a pet fish, and his name was Password123.
So, I guess that kind of, like,
hits both boxes and makes me more vulnerable.
Let's start by, uh, creating some strong and unique passwords
for all of your, uh, your different accounts.
And that will make them much more hacker-proof.
I'm all ears. Fantastic.
Well, we're going to start by rolling these five dice.
GALPERIN (voiceover): There are easy ways to create passwords
that are long and strong
and easy to remember that are not based on information
that attackers can easily find about you.
And the way that we do that is we use word lists and dice.
The word list is essentially just a long list
of dictionary words with numbers attached.
So what we're going to do is we're going
to write down the numbers on this dice.
45263, my new lucky numbers. Okay.
And now we are going to look up
45263 in this book.
So there are words that correlate to the numbers
that I just randomly rolled. Yes.
Okay. I want a cool word like "tiger."
The word is "presoak."
"Presoak?" "Presoak."
34115.
"Henna."
Okay, I like this.
PATEL (voiceover): The idea behind this dice game
is that it's both random and long.
Hackers using fast, powerful computers
and sophisticated password-cracking software
are able to try many, many passwords a second.
A recent study by a security firm
showed that a seven-character password can be cracked
in just a few seconds.
But a 12-character password
with uppercase letters and symbols
is much more difficult to break.
Studies show it could take hackers
well over 100 years to crack.
That's safe.
But also more difficult to type or remember.
Eva's six-word random passphrase
is easier to remember than a random string of 12 characters
and practically impossible to break.
"Stinging."
"Ignition."
Six is "Clutch." "Clutch," okay.
"Presoak Henna Stinging Ignition Clutch Handbrake."
(bell dings) Fantastic.
Now you have a passphrase.
These six words.
It is long. It's unique.
It's difficult to guess.
And it's relatively easy to remember,
considering how long it is.
It is a very good way of creating random passwords,
but a lot of password managers will automatically
do this for you.
PATEL (voiceover): Once you have a passphrase, you can use this
to unlock a password manager that generates
strong random passwords and stores them securely.
Now I have this beautiful random password or passphrase,
but what happens if someone steals this?
Is it just game over, efforts are gone?
No, it is not.
Uh, that leads us to the next step on your surveillance
self-defense journey, and that is two-factor authentication.
PATEL (voiceover): This may sound like a hacker ninja term,
but it's just an added layer of security,
requiring an additional method of confirming your identity.
Most of the time, it's just a simple text message.
GALPERIN: Because it requires
that you have two things
in order to log into your account.
You will need both your password and also this code,
so the site will send you a text message.
There is also an authenticator app.
The site will ask you to take a photo of and then go to
the site in a QR code.
The best way to be a security superhero
is to find the stuff that works for you
and implement it as sort of smoothly
and seamlessly as you can.
PATEL (voiceover): These data self-defense tweaks are great
for me and my own data.
But what about everyone else?
I'm wondering, is there a way for all of us to share data
and get all the sweet benefits,
without sacrificing privacy and security?
At M.I.T.'s Media Lab,
I'm meeting up with Ramesh Raskar,
who is working on a way to access the benefits
of personal health data--
finally, a topic I understand--
without compromising our private information.
At Ramesh's Camera Culture Lab,
they're building some data collecting tools
that seem straight out of a science fiction movie.
PATEL: Love when a sign says "Danger: Laser."
You know important things are happening in here.
(voiceover): They've got cameras that can literally see around corners.
PATEL: Get out! (both laughing)
RASKAR: We are not violating the laws of physics.
PATEL (voiceover): And cameras that can see inside our own bodies.
That's about as personal as it gets.
For Ramesh, protecting patient privacy is paramount.
But he's found a drawback in how we do that.
Since data is locked up for privacy,
advancement in medical science is not as fast as it could be.
Because, think about it, access to tons of personal health data
could help researchers make major medical breakthroughs.
But today, researchers have to ask for your consent
to peek at your data in order to learn from it.
RASKAR: When we talk about consent,
someone's still peeking into your data.
A no-peek privacy, on the other hand,
is where nobody can peek at your data.
PATEL (voiceover): No-peek privacy?
But how could researchers learn anything?
RASKAR: There are many ways
to create no-peek privacy.
First one is the notion of smashing information.
PATEL (voiceover): No, not literally smashing your phone.
But I'm not gonna lie...
...that was really fun.
Smashing is basically the idea of taking raw data
and smashing it into just the wisdom.
PATEL (voiceover): According to Ramesh, smashing data
is simply the process
of extracting the useful information,
which he calls the "wisdom,"
while obscuring the private data.
In other words, a collection of private health records
contains two kinds of data.
One kind is the personal data--
the names, conditions, and histories,
the stuff we absolutely want to protect.
But collectively, the records may contain valuable information
about patterns in health care.
The wisdom.
I'm thinking about examples in health care,
and the individual data, the patient data
is protected, and you can't reverse engineer it.
Let's take a concrete example of COVID.
Imagine during the early days of the pandemic,
we could have sent medical experts
from here in Boston to China, to Korea, to Italy,
and embedded them in those hospitals to understand
what COVID pneumonia looks like on a chest X-ray.
And they could have come back to Boston,
all those medical experts,
and said, "Hey, together, we can figure out what this is."
PATEL (voiceover): So, the experts would return back with just the wisdom,
an understanding of COVID
derived from being exposed to large data sets.
But they wouldn't come back with specific patient info.
None of the raw, sensitive, and private data.
But of course, that would require
initially sharing patient data;
a non-starter.
Because of privacy, because of regulations,
because of national security issues, they couldn't.
PATEL (voiceover): This is where A.I., Artificial Intelligence,
comes in.
Instead of sending experts to each hospital,
Ramesh is working on a way to send A.I. to learn instead.
An A.I. model could be trained on patients' lung X-rays
to learn what signs of COVID look like.
The private health data would never be copied
and would never leave the hospital or the patient's file.
The A.I. would only transmit its conclusions,
the wisdom, the smashed data.
RASKAR: It's not enough to just
remove the name from the chest X-ray,
but make sure that you don't send
any of the pixels of the chest X-ray at all.
PATEL (voiceover): The A.I. can learn patterns and gain knowledge
without having to keep hold of everyone's data.
So the "wisdom" from one hospital
can be combined with the "wisdom" of others.
RASKAR: Achieving privacy and benefits of the data simultaneously,
it's like having a cake and eating it, too; it's available.
And it's just a matter of convincing large companies
to play along those rules.
PATEL: Smashed data is one way we can learn to stop worrying
and love sharing our personal data.
But every corporate network would have to agree
to smash our raw data.
I'm not convinced we should wait around
for big tech companies to do this.
HILL: The big technology companies,
they have built the infrastructure
of the whole internet.
You're not just interacting with these companies
when you know you're interacting with them.
PATEL: Even if it seems like you're on
a totally independent website, big tech still sees you.
For example, tons of websites,
like some of the ones owned by NASA, Pfizer, BMW,
even PBS, use Amazon Web Services,
which means Amazon gets some data when you visit them.
Or when you visit any app on your iPhone,
Apple knows.
Also, every time you've been to a webpage
that has a Facebook "like" button,
Facebook gets to gobble up your personal data.
KAHLE: So it may seem
like the web is decentralized
because it comes from many different places.
But in fact,
there's centralized points of control.
CHOWDHURY: Right now, for example, when you are in a social media app,
you're sort of locked in, right?
All your information is on there.
It's hard to leave a social media app
because you're like, "All my friends are there,
all my photos are there.
"If I move to another app,
I have to rebuild that community."
GALPERIN: Those social media websites are controlled
by a very small number of companies.
And the rules about using those websites,
who has access to them and what kind of behavior is acceptable
on them, are set by the websites themselves.
PATEL: This centralized data monopoly, how do we start to dismantle it?
That's exactly what proponents of an idea
called the decentralized web want to do.
GALPERIN: The decentralized web is sort of our antidote,
the antithesis of the web as we now think of it.
CHRISTINE LEMMER-WEBBER: The decentralized web can be seen in contrast
to the centralized web, of course.
Instead of what has become,
on the internet, of a few big players kind of controlling
a lot of the web and the internet space,
we're really kind of rolling things back
to kind of what the vision of the internet was.
PATEL: I'm wondering what a decentralized web
would look and feel like?
So I'm meeting up with coder Christine Lemmer-Webber,
who is working on writing the standards and rules
for how social media could work on a decentralized web.
LEMMER-WEBBER: Most people are familiar
with social networks: you know, they've used,
you know, X-slash-Twitter;
they've used Facebook; they've used Instagram.
The decentralized social web is
like that, but no one company,
no one gatekeeper controls the thing.
We want to be able to have
all of our different social media sites,
all of our different online communication tools
be able to talk to each other.
DOCTOROW: A decentralized web
is one that is focused on
the self-determination of users.
You're not locked in.
So you find a service, and you like it.
(duck quacks)
And then you and they start to part ways.
The art you made, the stories you told are there.
In a decentralized web, you go somewhere else.
You go somewhere else, and you don't lose any of that.
PATEL (voiceover): But imagine, instead of having one Facebook-type company,
we each had our own data live on our own devices,
and it was easy to join or merge with others,
or disconnect from them.
Leaving one group and joining another
wouldn't mean rebuilding everything from scratch
because your data moves with you.
It sounds like a tech fantasy.
But it's actually something we've already proven
works online.
Consider something you may use every day,
or if you're like me, every minute: email.
LEMMER-WEBBER: So what a lot of people don't realize
is that they use decentralized networks every day.
It doesn't matter if somebody's on Gmail,
or if they're on Hotmail,
they're on their university email.
They don't even have to think about it.
They type an email to their friend,
and they send it off, and it gets there, right?
At the heart of it, that's kind of the basics
of what we're doing.
PATEL: In other words, you can get an email sent from Hotmail
even if you have a Gmail account.
Or you can create your own email server, for that matter.
It doesn't matter what email service you use
because the protocol, the rules, are written
to allow the email servers to talk to one another.
LEMMER-WEBBER: That's because there's a shared protocol that says,
here's how we get the messages from place to place.
Social networks could just work like email.
PATEL: And in fact, there are plenty of decentralized projects
out there like Mastodon
and Blue Sky
putting the user's profile and data
back into the users' hands.
LEMMER-WEBBER: In the systems we're moving towards
that will be much more the case
where private communication is much more private.
They're, by default, secure in that type of way.
We're building new foundations
for the internet that allow for healthier,
safer, more decentralized systems, gatekeeper-free.
That's the vision and the future we're trying to build.
PATEL: No doubt, there are secrets in your data.
NOBLE: Everything we touch is increasingly datafied,
every dimension of our lives.
CHOWDHURY: All of this data goes into feed algorithms.
And algorithms make predictions
about how long you will live,
or your health, or your lifestyle.
PATEL (voiceover): And while I learned how to protect
my personal privacy and security,
there's only so much I can do myself.
HILL: There are things that individuals
can do to protect their privacy.
Ultimately, in order to
avoid a huge crisis, it requires systemic change.
GALPERIN: There are limits to what we can do as individuals.
There are also things that need to be addressed
through regulation, through litigation,
and through legislation in order to make all of us safer.
PATEL: It's comforting to know there are techies out there
trying to protect us and our data,
designing new ways to enjoy the fun and convenience
of the digital world without being exploited.
KAHLE: New technologies, new games can proliferate
without centralized points of control.
That's the excitement of the decentralized web.
LEMMER-WEBBER: I can't wait for people to see this vision
we're building for collaborative, more consensual,
decentralized social networks.
That's going to be really exciting.
PATEL: The future we're building might not look too different
from the internet of today.
But it could be much more private and secure,
if we get it right.
DOCTOROW: This is about how technological self-determination
and regulation work together
to make a world that is more safe for human habitation.
♪ ♪