EP232 The Human Element of Privacy: Protecting High-Risk Targets and Designing Systems

Security running.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Timothy Peacock, the Senior PM for Detection Platform UEBA and Risk in Google SecOps, and of course, Anton Chuvakin, a reformed analyst and now senior staff in Google Cloud's Office of the CISO. Find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us, and the rest of our Cloud Security Podcast listeners on the Google Cloud Security Community page. Anton, we are fixing your fears today on the show.

Oh, yes.

Today was definitely a watershed episode for me because we brought up a topic that I sort of swore off discussing on the show out of my innate fear of lawyer cats and their claws and their meowing, perhaps even. So at this point, we really had a very fun discussion, I would say.

We did. This is a special episode for me personally. I've had a Brown professor of mine on the show, and now I've had a Brown classmate of mine on the show. So it's wonderful to keep that network going. And I think the topic is very timely, very interesting. And maybe without any further ado, Let's turn things over without any cats to today's guest. Today we are joined by my college classmate, member of a minor cult we were both a part of for— yes, we agree. Sarah Oon, a privacy engineer at Google. I think it's our first time having a privacy engineer on the show.

It is. Is it?

I think it is. Anton, is it?

I mean, not to go on a rant so quickly in the show, but we've been kind of avoiding the P word.

Oh, please.

Out of the fear that the lawyer cats will start dropping out of the ventilation shafts on us for mentioning the P word.

Honestly, to be To be fair, there's not a lot of us in the world. I mean, I Googled also in the world. Yeah, it's such a niche, uh, title or job.

It is.

I would say it is.

So you've had a much cooler career than I have since we graduated from college. And you mentioned before we started the call that you've consulted with a literal world leader on their personal digital security footprint. Can you tell the listeners and tell me, because I'm super curious, how you got into this and You know, how are you helping keep targeted individuals secure?

Yeah, definitely. I mean, it's, a friend of mine a few years ago had said that anyone getting into this field of security and human rights has a very weird background, like a mutated spider background situation, which made me laugh a lot because it felt really accurate. There's no specific path into this work. Like, you don't go to school for doing cybersecurity in the context of human rights or social justice or nonprofits. So everyone has a very strange background about how they got into this work. In my case, after we graduated from school, I went on to work for a human rights nonprofit. And that's kind of what I did for a while and was always super fascinated by computers. I found my origin story in my childhood photos of being 3 years old in front of a computer.

No way.

Trying to break into the computer and hacking away, which was amazing. I was like, finally, I found my origin story. This was it.

That's incredible. Anton, did they have computers when you were 3 years old?

Oh, yes, they did have a mainframe.

Okay.

My dad, I think, was one of the first people in Lebanon to have a Mac. I mean, back in the day when it was that huge, humongous box, like no one had— everyone had like PC and Windows. And my dad was at the time, he was like, there's this new company, a new computer, a new whatever. And then I don't know how he managed to get one into Lebanon, but he did. So that was origin story. But going back to this human rights nonprofit. I was with them for a while and then moved from them to a data mapping company, which that nonprofit that I was working at had used to map like LGBT abuses around the world, something like that. So I had been in touch with the team there and then moved basically over to work with them, which was a really fascinating experience and really awesome. And one of the things that I got to do while working with them was— honestly, to fly across the world working with nonprofits on a lot of the data mapping and collection that they were doing. Like a lot of researchers were gathering information about some, say again, like human rights abuses on XYZ topic, and they had the dataset and they didn't know what to do with it.

Yes.

And they wanted to map it and visualize it. But in my case, I remember being in an Arab country, where a team of researchers was actually gathering data on the LGBT population of the region.

What could go wrong?

Exactly, what could go wrong? So they show me this, they came to me being like, we wanna visualize it and map it. And I'm like, can I see this data? And essentially they had done interviews with people and had first name, last name, home address, phone number, family relations, all on a piece of paper and were walking around with it. I was like, whoa, whoa, you're essentially walking with a hit list.

Oh no.

You're walking with a hit list.

That's terrifying. Than a Notepad file, right? So in that sense, a piece of paper is probably safer than a file on their computer with Notepad.

It depends on the, on the context, but in this case, it was in a city where checkpoints were actually quite common. So getting stopped at a checkpoint and having an officer search you was common. So having it on a piece of paper was not necessarily a wonderful idea. And at the time, I was there to actually work on data mapping and visualization and had to really slow this down with the researchers and essentially just pivot the conversation to what felt like common sense to me at the time, but talking about privacy and security. Like privacy, why are we collecting this data in this way? Do we really need this information to achieve the goal that you're trying to achieve? And why does it have to be on this piece of paper? And that's kind of what ended up happening when I was with this company is that most of the consultations that I did actually instead of before talking about mapping and visualization, we ended up talking about privacy and security.

Hmm.

And so because of it, I started learning a little bit more about cybersecurity and about privacy in order to have these conversations in a more helpful way. And that's kind of how I pivoted into that. And at a time where I couldn't find or meet anyone else who worked on privacy and cybersecurity specifically in the context of human rights. And eventually, a couple of years later, I ended up at this very small conference that brought together essentially technologists and some privacy and security people and human rights folks who were all kind of working on this topic.

Speaking of targeting lists.

Exactly. Years ago. Right now, it's actually— it's Like talking about the dangers of technology is pretty ubiquitous, but I'm saying like 10, 15 years ago, it wasn't really a topic.

Oh, that's a while ago now, yeah.

Yeah, it wasn't really a topic of conversation. I remember being at that conference and you know that Spider-Man meme that's like, you're doing it, wait, I'm doing it, is this you? That's how it felt like being at this conference where we're all like, wait, you work on human rights and security? You're thinking about the dangers of technology? You're thinking about surveillance or hacking or spyware. And it was, it was incredible to be connected to people. And since then, the community has grown a lot. I mean, this conference, at the time we were 200, 300 people. Today, it's— when we go to it, it's capped at 2,000 people.

Really?

Wow. Wow. So definitely quite a bit. Oh yeah, yeah. The field has definitely grown. There's a lot of people who are thinking about the dangers of, I guess, technology, how it impacts Society, privacy, security, all of that, essentially. That's kind of— it's a long, long way to where I am now. But that's essentially how I got into this field of working with targeted individuals and high-risk users on privacy and security.

Okay.

But you also have a day job, right?

And yeah, this is like your side gig.

Yeah, no, I was kind of like, the fascinating story is kind of like, we can pursue this and have an episode out of it. But you also do presumably very fun stuff at work. You're a privacy engineer working on Fuchsia, right? Our new OS kernel, which I think is powering one of the displays I have in front of me. I think one of the— it was mentioning something about that name during an update. So I kind of know that it's staring me in my face.

Right, right.

Staring you in the face, yes.

Yes, the Fuchsia. So how do you go, maybe, I don't know, how do you connect both sides of you? How do you connect the human rights side, the privacy side to the day job privacy, working on ambient displays, such as the one that I'm staring at?

It's a great question. And honestly, sometimes feels like a leap in my head when I think about it, but it's not so much so actually, because at the time, yes, now I have a day job of being a privacy engineer at Google. And what I was just talking about is what I've been doing for the past 15 years or so. But in making the connection and the jump to Google, what really sold me on joining this specific team, so the Fuchsia team, which is an operating system which is powering all the smart display devices. What made me interested in this position, got me interested in it at the time, my colleague who's here right now on the team with me had been involved in the same field of work as me. So working on privacy security in the context of human rights and had just joined Google working on the Fuchsia team. And one of the selling points, or one of the things that got me intrigued, I guess, was the chance or the opportunity to work on a very granular level on privacy on a certain system that could impact billions of users. So going from a very micro-level type of work that I had been doing to a really macro approach to privacy and security.

That's interesting. Yeah.

So thinking about how to raise the privacy standard and develop a privacy architecture for an operating system that billions of users may end up using.

Yeah.

And at the time, I mean, we're a very small privacy team. And I remember my colleague, now colleague, telling me, it would just be you and I, Sarah, deciding what privacy means. We get to really have such a strong impact on designing privacy architecture for users. And having that level of impact was an interesting shift For me, and a different way of thinking about privacy and security and defining it with the most high-risk users in mind and defining privacy and security for that case study. And when you're doing it at that level, you're essentially impacting everyone else.

Sure, sure. So how do you do that? I mean, smart displays, like an always-on device that you, by its nature, forget is there. So people are gonna say the most private stuff in front of it, do the most private stuff in front of it. How do you actually engineer privacy into that?

Uh, we basically say no to a lot of people.

So you're good at saying no.

I would assume that you would say no to a lot of people who come to you with money-making ideas. I think that I've heard that. Yes.

I am joking. It is, I think, a stereotype of privacy teams at Google that we're the teams that say no to people and we kill the fun ideas.

Um, some PMs, colleagues of mine have expressed this.

Right, exactly. In my case, I do think that we try very hard to meet people where they're at and to work with them to find solutions.

Sure.

Like, they want to achieve a certain goal, they have a certain idea or feature in mind, and they're not necessarily sure on how to get there, mostly because of not having necessarily privacy at the forefront, right?

Sure.

Of their mind. So for us, it's assisting this team to get to this feature or to get to this idea that they have while Keeping privacy in mind. So you want to be collecting data for some sleep sensing activity.

Yeah, yeah, sure.

Do we need to collect all of the data all the time? Do we need to keep the data forever? So it's really thinking about the problem and coming up with creative solutions around it to still make it happen, but make it happen in a way that we're protecting the user at the end of the day as much as possible.

So to drill down into this a little bit, and it's possibly my obsession more than the The key topic, but sometimes it feels like we do a lot of work in this area, and then the outside world sort of assumes that we don't.

Oh, yeah, we get that quite a bit.

Yeah, the chasm is just so huge, at least in my mind. So, I'm kind of curious not only how you do it, but also how you convince people that we did it. Because, I mean, I'm a weird guy. I trust Google. I mean, I can say it on a public podcast, and if somebody shows me a device that I can dogfood, and it collects all sorts of private info and it asks, do you trust Google to handle it well? I'd be like, yeah, I trust Google to handle it well. And I mean it. But maybe I'm weird because of it. And some people perhaps aren't as trusting of Google. I don't know. My point, how do we convince others that we do it? Because we do do it.

You know, it's easy to convince people. It's easy to convince people that Anton is weird.

All right. There is that. Yes.

I get that. I'm very curious. How do you convince people that these devices are indeed private?

Actually, I think that's a great observation. And I I think that's been one of the biggest takeaways for me joining Google. Because from the outside, it's true. Like, we do think that Google is not doing a very good job necessarily, or any of the big tech companies are completely driven by profit at the expense of user privacy and security and whatnot. And now that I've been in this team and seen how this works, I will say that we actually fight tooth and nail all the time to protect users as much as possible. So that's been a very interesting shift in perspective for me in terms of getting to a place where I do trust that people are trying very hard to do the right thing. How to convince people, I mean, I do my part every day by telling people I work very hard to make sure their privacy is protected. But I think unfortunately it's, you know, when someone like is a great person and then they make a mistake and people just remember the mistake a lot, but they do not remember that they're also a great person for all the other X, Y reasons. I feel like it's the same for these stories. There's one kind of intense headline in the news about like X company is spying on you and collecting blah, blah, blah data. And the headline very often is a little clickbaity and actually just false sometimes.

For sure, for sure.

And then when you drill down and you actually read the article, you're like, wait, but that wasn't like, they didn't leak all the passwords. That's not what happened. That's not exactly what happened. So I will say, I mean, the media plays a role in it for sure. And then unfortunately, I will say that privacy is not always the top priority for the companies. It is something that they're thinking about, but, and it is something that they care about, but it's at the end of the day, the bottom line is also putting out certain features and creating certain products sometimes to just keep up with the market. So some things have to be deprioritized and sometimes privacy is the thing that gets deprioritized, not to the extent of compromising users, but it is— we don't necessarily always have the final say on certain things, right? We get to suggest things and give an opinion, a very strong opinion about certain things, but we can often get overridden, I would say. I know, and I do believe in the integrity of the people doing this work and like really pushing to make a product And also, the reality is that there is a lot of pressure in the type of world that we live in to produce certain products and features and whatnot. And it is a point of contention that people deal with.

I mean, that's— maybe we made a mistake that we avoided the P word for 230 episodes, because of course, these discussions can be fascinating. And believe it or not, my fear of lawyer cats falling out of my ventilation shaft has Decreased a little bit. So maybe— That's not bad enough. Yes. This is a weird side question to this question. A few times I've also observed that people confuse all sorts of things in privacy. And I had a debate with somebody about my dashcam recordings. I drive a car and it has a dashcam. I said a recording would do this, this, this. And they said, what about privacy? And I'm like, it's recorded from a public car on the public road. What are you talking about privacy? And they're like, no, no, there are privacy implications. And I'm like, I don't think so. It's my car on the public road. I can record. But then basically convinced me that I was wrong because in those circumstances, public recording had privacy risks, which to me didn't fit into my head at the time. It was 10 years ago. So it's confusing what it is sometimes to people.

It is. It is confusing. And I think a lot of people conflate also privacy with having something to hide. That's a conversation that I have with folks often where I am trying to make the case for privacy, and the counterargument is often, well, we got nothing to hide. We're not doing anything wrong.

So why would we— Privacy is secrecy.

Exactly. Privacy is also institution, and it's 2 totally different things. My favorite response to that is always asking for someone to hand me their phone with their passcode. Since they have nothing to hide, it's totally fine. Just hand over your phone.

Let me see your Reddit account. Let me see your Twitter account.

And this is when it kind of clicks for people that it's not about secrecy or doing something wrong. It's just that people have a right Yes.

So I want to shift back to kind of the world we live in and people's rights and talk about the high-risk individuals, because you do a lot of work with high-risk individuals. And some of these are obvious— journalists, activists— but I think there are lots of other people that are too. And so how can somebody assess themselves to understand if they might be at an elevated risk for being targeted by a nation-state or a That sort of thing.

There's a test online that you can take.

No way.

No, no, I'm kidding.

You got both of us actually.

Yeah, we were both like ready to Google this test.

Just give me a yell.

Yeah, that would make my job a lot easier. No, there isn't.

You should make that test.

That would be funny. But it will—

what a terrible honeypot.

Exactly. And the answer is it depends. It really depends on the, on the world that we live in. I mean, because the geopolitical—

which shifts very quickly.

geopolitical context is shifting a lot. Let's take the US as an example. Someone trying to have an abortion a few years ago is not a high-risk individual. Today, yes, a high-risk individual is someone trying to have an abortion in certain states in the US. LGBT folks in the US, trans folks in the US.

Happy Pride Month.

Happy Pride Month. Yes, best month. So immigrants, I mean immigrants, brown people, Arab people, Black people, I mean it just, it shifts the definition of who is high risk shifts also depending on the geopolitical context that we live in. And a higher risk person in the US might not also be a higher risk person in France or a higher risk person in Egypt. And it does change. So it is important to understand the context and the environment that you, that you live in. And sometimes there's a lot of like higher risk folks that we don't think of as higher risk folks. Like, for instance, Here in the US, older people who are more prone to scams and social engineering.

For sure.

Right, receiving a call from someone pretending to be the IRS and trying to get you to transfer some money or pay some outstanding debt. The folks who would fall for this most likely in the US are the older population that's targeted all the time. So we wouldn't necessarily think of them as like high-risk individuals, but like actually, yeah. So it really is an amalgamation of so many aspects of your identity, from race to age to profile to ethnicity to sexual orientation to gender presentation, that make up whatever high-risk definition you might be thinking about.

Yikes.

So I think that it depends is almost like the answer I expected. But I think that the variance based on time and geography also makes sense. And I think even the time-based argument to me just resonated with me because you can live in the same place, you cannot move beyond 20 miles of your house, and you may be not high risk, high risk, not high risk. I mean, that may actually— the world may change around you, and even though you didn't do anything at all, you didn't move from Egypt to France or from Russia to US, like, it doesn't really— nothing changes. Well, you don't change, but the world does.

Yes.

Absolutely.

So, as far as tips, I'm also kind of curious When I casually skim advice for these circumstances, it varies from very basic, like good passwords, MFA, whatever, to kind of extreme, all sorts of burners. If you go take out trash, you need to get a burner with you because what if something happens? I don't know. Tim is making fun of me now. Tim is going to make fun of me for that too. But I have 2 questions connected to this. Tech versus behavioral change. And what is the— the rest of the top 3, top 5 tips for this, like digital hygiene behavioral, digital hygiene technical. I mean, I had a friend with a modern Android phone who refuses to set a password on the phone. Like, it's unlocked with— and I'm like, I cringe every time I see her because of that decision, right? And so I guess it does vary.

It does. It varies a lot. There's a few ways to— I mean, I have so much to say honestly about this question. I'm gonna start with this notion of collective responsibility based on the example that you just gave. A lot of people might not care about their own privacy or their own security profile, but when you start thinking about the people that you're in community with and that your security and your privacy actually impacts the people that are around you in your periphery and in your community. For instance, I've worked with an immigration lawyer before who didn't really care much about their privacy. or their security, as in did not have a passcode also on their phone. And in having that conversation, they were like, well, it doesn't matter, I don't care, I have nothing to hide. But in continuing that conversation, once I got to the point where they actually work on sensitive cases and they work with undocumented folks, and a lot of that information is on their phone because they have messages with people, they have emails with people, that's when it clicked for them. So it's not just about thinking, about your security and your privacy. It's really a collective responsibility and the people that you're in touch with and community with, etc. So that's one thing. In terms of tips and approaches, it really— there's kind of 2 buckets with that. There is the individual responsibility of changing your habits. It is a little bit like brushing your teeth and where you're adding a little bit more effort every day. I mean, having, you know, Implementing certain privacy and security practices does add friction to people's day-to-day habits. For instance, you're in your house, you leave your house, you're not used to locking your door, and all of a sudden one day I come in and I say, well, you got to start locking your door.

Hmm.

You're adding a few extra seconds in people's day in doing it, and they might be a little bit annoyed in doing it, but after a while it just becomes part of their daily routine is to exit the house and also lock the door behind them. So there is a behavioral change in that sense of just incremental steps every day to increase your privacy and security, just like brushing your teeth and trying to maintain good digital hygiene. That's one aspect of it. The other aspect of it is the responsibility of people like us working in tech companies in terms of baking in privacy and security by default to make this less difficult for everyday users. and to lower that bar of entry as much as possible for people. So to think about creating privacy by default and privacy by design, or security by default, security by design for people, instead of putting that responsibility on the user, because that's a lot. I mean, technology is, there's a lot, there's so much stuff in the world, especially now.

And it keeps changing too.

And it keeps changing, of course. And keeping up with it is very hard. So doing our best to secure people by design, as opposed to putting that responsibility on them, How I see at least my role here.

I think that's great. So we're getting close to the end of the episode. And I want to ask, given your background in both individuals and building an operating system at Google scale for billions of users, what do you wish developers and engineers building cloud services would think about when it comes to privacy and individual security? What would you tell them? Because that's who listens to our show. So what do you want to tell them to make the world a better place?

It really is the idea of what I was just talking about, like privacy and security by design, making that as easy as possible for the user. I think what's fascinating is the people that are developing this type of technology, we're sitting, most of the time we're sitting here in the US developing technology that is being used by people all around the world in use cases that like we don't even think about. We're not thinking that there's a family of 5 people using one phone.

Right.

But like that does happen in the world.

Of course.

That does exist in the world. As a very clear example, when working with high-risk individuals in certain countries, the fact that WhatsApp is encrypted and then is an encrypted application is a very important thing to remember. However, for a very long time, WhatsApp chats were backed up to iCloud and iCloud was not encrypted. So that was used to target people in certain places who thought they were having encrypted conversations because of—

It says encrypted.

It says encrypted. It is encrypted. However, the iCloud backup was not. Apple has changed that since then, and now you can have an encrypted backup of your chats. But that was a big use case actually for a very long time for people that actually did endanger people around the world. And users don't, are not necessarily thinking about this granularity of information and details in the settings. Sure, sure, sure. Why would they? So when we are thinking about cloud security and cloud privacy, it really is actually trying to work with people in different places around the world on different use cases, things that we might not be thinking about and that are not at all on our radar because we don't have this lived experience. But it is other people's lived experience, and the way that they're using these applications is very different than how we're using it. And it is something to be thinking about and to have the humility to, to just know that you don't know everything and that you might have a blind spot that you're not thinking about, and to be able to approach other people and other communities and other folks around the world and trying to understand like how they're interacting with this and then build a product that would also help them, secure them, keep them safe.

Yeah, that actually resonates a lot. And it's kind of interesting because we do end up being a bit of Bay Area minded sometimes. And I've seen examples where people want to scream at the ether for like, have you tested it with people other than Google engineers? Of course, we are very proud to dogfood stuff. But if it's built for— it was about a particular app for family, actually. Well, especially about Google Family Link, was they up? And I'm like, yeah, but somebody from another country told me that it doesn't work for them. And I'm like, we really carefully dogfooded this, but probably with a lot of Google engineers with children.

Yeah.

So that's a much less extreme example than yours, but yeah. Okay, so I hate to do this, as Tim usually says, I want to get to closing questions. And we usually ask 2. Give us one tip, and in this case, a tip for practical privacy, And give us one resource or reading. When I say resource, it sounds— starts to sound like it has to be a technical resource, but give us one piece of reading.

One tip for privacy. I think one of my favorite ones is, you know, when you're signing up for, say, a discount at your grocery market next to your house, or you're shopping in person and trying to buy clothes from H&M, say, and in each case, in both cases, They're asking you for your first name, for your last name, for your home address, for your email, for your phone number to send you the receipt or for you to sign up for discounts. You don't have to give that information. This is something that I have to remind people all the time. I'm like, no one is forcing you to give this information. You do not have to give this information. And we have, I mean, humans—

This is such an opportunity for creatively make up a name. I do it all the time. And now you told me I don't have to come up with a new name every time.

Even better. even better, definitely come up with fake information. I get fake information all the time for this stuff. But one thing in the US specifically is that there's no data protection law.

Hmm.

So companies like data brokers have no regulation around them and collect a ton of information about people, as in their home address, their phone number, their family relations. And you can find a lot of this information online, unfortunately. And a lot of this information is gathered from even things as silly as your grocery discounts sign up. So just keeping in mind that whenever humans have this weird relationship with authority, if someone is asking you something, you have— you feel obliged to give the information. You don't. You do not have to give your home address or your phone number to any clothing store or random like email sign up, or when you're signing up for free Wi-Fi at the airport and they're asking you—

Oh, I always put a fake name in there.

It's great.

Exactly. And they ask you for your passport number. Please do not give your passport number for free.

That's only in some countries though. Yeah, that's probably not— yeah, I've seen that and I usually kind of freak out and stop if I see that.

It's weird, my passport number is 123456789. So strange. I got really lucky with that one.

You did get really lucky with that one. That's an easy one to remember.

Easy to remember, easy to type. Do you have recommended reading as well?

Yeah, there's a lot of really great resources online. I'm thinking about certain organizations like the Electronic Frontier Foundation has a lot of— yeah, a lot of really great resources for people to check out and read and a lot of good security and privacy guides, entry-level guides for people to read as well if they're concerned about how to use their devices, their laptops, their phones. And then things like that are more current to today's geopolitical context, for instance, how to cross a border in a way that feels safe and secure and is protecting your, your devices and yourself as much as possible.

Nice.

Well, I will look for the quiz that tells me whether I'm a high-risk individual, fill it out with my home address and social And Sarah, I can't thank you enough for joining us today.

No, thank you both so much.

And now we are out of time. Thank you very much for listening, and of course, for subscribing. Please subscribe so you can get new episodes piping hot. And if you love our content, please drop us a review on your platform of choice.

You can find this podcast on YouTube, Apple Podcasts, Spotify, or wherever you get your podcasts. Also, you can find us on our website, cloud.withgoogle.com/cloudsecurity/podcasts. You can argue with us on the Google Cloud Security Community site, googlecloudcommunity.com.

You can follow us on X, x.com/cloudsecpodcast. Tweet at us, email us, argue with us. And if we like or hate what we hear, we can invite you to the next episode.

See you on the next episode of the Cloud Security Podcast by Google. Secure running.

Secure running.