How tech companies deceive you into giving up your data and privacy | Finn Lützow-Holm Myrstad

翻译人员: jacks peng 校对人员: Yinchun Rui

Do you remember when you were a child,

你还记得童年时期，

you probably had a favorite toy that was a constant companion,

你可能有一个钟爱的玩具与你形影不离，

like Christopher Robin had Winnie the Pooh,

就像克里斯多夫 · 罗宾有小熊维尼一样，

and your imagination fueled endless adventures?

以及你那充满无尽冒险的想象力吗？

What could be more innocent than that?

还有什么比这个更天真的呢？

Well, let me introduce you to my friend Cayla.

让我向你们介绍我的朋友凯拉。

Cayla was voted toy of the year in countries around the world.

凯拉是全球各个国家投票选出的年度玩具。

She connects to the internet and uses speech recognition technology

她能与互联网连接并使用语音识别技术

to answer your child's questions,

来回答孩子们的问题，

respond just like a friend.

就像一个朋友一样。

But the power doesn't lie with your child's imagination.

但权力并不在你孩子的想象力中。

It actually lies with the company harvesting masses of personal information

它其实在于公司所收集的 海量个人信息上，

while your family is innocently chatting away in the safety of their home,

你的家人在安全的家中闲聊时，

a dangerously false sense of security.

这其实是一种对于安全感的危险错觉。

This case sounded alarm bells for me,

这个案子给我敲响了警钟，

as it is my job to protect consumers' rights in my country.

因为我的工作是保护 我们国家消费者的权益。

And with billions of devices such as cars,

随着到2020年，数十亿诸如

energy meters and even vacuum cleaners expected to come online by 2020,

汽车，能源仪表，甚至吸尘器 那样的设备投入使用，

we thought this was a case worth investigating further.

我们认为这个案例值得深入调查。

Because what was Cayla doing

我们很好奇，凯拉用她所学到的

with all the interesting things she was learning?

所有有趣的东西，到底做了些什么呢？

Did she have another friend she was loyal to and shared her information with?

她有没有另一个忠实的朋友， 分享她的信息？

Yes, you guessed right. She did.

是的，你猜对了，她有的。

In order to play with Cayla,

要跟凯拉玩耍，

you need to download an app to access all her features.

你需要下载一个APP 来获取她所有的功能。

Parents must consent to the terms being changed without notice.

家长必须同意更改条款而毋须另行通知。

The recordings of the child, her friends and family,

孩子们，她的好友和家人的录音，

can be used for targeted advertising.

可以被用于定向广告。

And all this information can be shared with unnamed third parties.

并且所有这些信息都可以 与未具名的第三方分享。

Enough? Not quite.

就这些了？其实还不止。

Anyone with a smartphone can connect to Cayla

任何有智能手机的人在一定的距离内

within a certain distance.

都可以连接到凯拉。

When we confronted the company that made and programmed Cayla,

当我们与制造和开发凯拉的公司对峙时，

they issued a series of statements

他们发表了一系列的声明称

that one had to be an IT expert in order to breach the security.

只有IT专家才能破坏其安全性。

Shall we fact-check that statement and live hack Cayla together?

我们要不要一起核实一下这份声明， 直播一下如何“劫持”凯拉？

Here she is.

这就是她。

Cayla is equipped with a Bluetooth device

凯拉装备有蓝牙设备，

which can transmit up to 60 feet,

传输距离可以达到60英尺，

a bit less if there's a wall between.

如果有墙阻挡就少点。

That means I, or any stranger, can connect to the doll

这意味着，我或任何陌生人

while being outside the room where Cayla and her friends are.

在凯拉和她朋友的 家门口就能连接上她。

And to illustrate this,

为了演示这个过程，

I'm going to turn Cayla on now.

我现在把凯拉开机。

Let's see, one, two, three.

让我们看看，1，2，3.

There. She's on. And I asked a colleague

好了，她开机了，我之前让一位同事

拿着他的智能手机站在门外，

to stand outside with his smartphone,

and he's connected,

现在他连上了，

and to make this a bit creepier ...

为了加点恐怖的气氛…

(Laughter)

（笑声）

let's see what kids could hear Cayla say in the safety of their room.

让我们看看孩子们会在他们安全的 家中听到凯拉说什么。

Man: Hi. My name is Cayla. What is yours?

男：嗨，我叫凯拉，你的名字呢？

Finn Myrstad: Uh, Finn.

芬恩：芬恩。

Man: Is your mom close by?

男：你妈妈在旁边吗？

FM: Uh, no, she's in the store.

芬恩：不在，她在店里。

Man: Ah. Do you want to come out and play with me?

男：啊，你想出来跟我一起玩耍吗？

FM: That's a great idea.

芬恩：真是好主意呀。

Man: Ah, great.

男：好呀。

FM: I'm going to turn Cayla off now.

芬恩：我现在要关掉凯拉了。

(Laughter)

（笑声）

We needed no password

我们无须任何密码

or to circumvent any other type of security to do this.

或规避任何其他安全措施就可以做到。

We published a report in 20 countries around the world,

我们在全球20个国家发布了一份报告，

exposing this significant security flaw

曝光了这种明显的安全漏洞

and many other problematic issues.

和很多其他问题。

So what happened?

后来怎么样了呢？

Cayla was banned in Germany,

凯拉在德国被禁止出售，

taken off the shelves by Amazon and Wal-Mart,

被亚马逊和沃尔玛下架，

and she's now peacefully resting

现在她正平静地呆在

at the German Spy Museum in Berlin.

柏林的德国间谍博物馆。

(Laughter)

（笑声）

However, Cayla was also for sale in stores around the world

然而，在我们报告发布前，凯拉已经在

for more than a year after we published our report.

全球各地的商店出售超过一年。

What we uncovered is that there are few rules to protect us

我们所揭示的是， 很少有规则能够保护我们，

and the ones we have are not being properly enforced.

并且有的规则往往也 得不到很好的执行。

We need to get the security and privacy of these devices right

在它们进入市场时，我们需要让

before they enter the market,

这些设备具备可靠的安全和隐私功能，

because what is the point of locking a house with a key

因为如果任何人都可以 通过一个联网设备进来，

if anyone can enter it through a connected device?

用钥匙锁门的意义又何在？

You may well think, "This will not happen to me.

你可能会觉得，“这没发生在我身上。

I will just stay away from these flawed devices."

我只需要远离这些有缺陷的设备就好。”

But that won't keep you safe,

但这无法保证你的安全，

because simply by connecting to the internet,

因为只是通过连接上互联网，

you are put in an impossible take-it-or-leave-it position.

你就不可避免地被置于 要么接受，要么走人的境地。

Let me show you.

给大家看看。

Like most of you, I have dozens of apps on my phone,

像很多人一样，我手机上有几十个应用，

and used properly, they can make our lives easier,

使用得当，它们可以让我们生活更轻松，

more convenient and maybe even healthier.

更便捷，甚至可能更健康。

But have we been lulled into a false sense of security?

但我们是否被一种 虚假的安全感蒙蔽了呢？

It starts simply by ticking a box.

它开始于简单勾选一个方框开始。

Yes, we say,

是的，我们会说，

I've read the terms.

我已经阅读过这些条款。

But have you really read the terms?

但你真的阅读了这些条款吗？

Are you sure they didn't look too long

你确定它们不是看起来太长，

and your phone was running out of battery,

你的手机快没电了，

and the last time you tried they were impossible to understand,

你最后一次尝试时， 它们非常晦涩难懂，

and you needed to use the service now?

而且你需要立刻使用这个服务？

And now, the power imbalance is established,

目前，权力的不平衡已经建立，

because we have agreed to our personal information

因为我们同意让对方 收集我们的个人信息，

being gathered and used on a scale we could never imagine.

并用于我们无法想象的规模层面。

This is why my colleagues and I decided to take a deeper look at this.

这就是我和同事们决定去 深入研究这个问题的原因。

We set out to read the terms

我们开始阅读

of popular apps on an average phone.

一台普通手机上热门应用的条款。

And to show the world how unrealistic it is

并且向世界展示，让消费者去阅读

to expect consumers to actually read the terms,

这些条款是多么的不切实际，

we printed them,

我们把这些条款打印出来，

more than 900 pages,

总长度超过了900页纸，

and sat down in our office and read them out loud ourselves,

然后坐在办公室里大声朗读，

streaming the experiment live on our websites.

并在我们的网站上直播这个实验。

As you can see, it took quite a long time.

很显然，需要花很长的时间。

It took us 31 hours, 49 minutes and 11 seconds

我们花了31个小时，49分钟11秒

to read the terms on an average phone.

才阅读完一台普通手机上的条款。

That is longer than a movie marathon of the "Harry Potter" movies

这比《哈利波特》和《教父》

and the "Godfather" movies combined.

系列电影加起来还长。

(Laughter)

（笑声）

And reading is one thing.

阅读是一回事，

Understanding is another story.

理解则是另外一码事。

That would have taken us much, much longer.

这会需要我们更多更多的时间。

And this is a real problem,

这是一个切实存在的问题，

because companies have argued for 20 to 30 years

因为这些公司争执了20-30年，

against regulating the internet better,

反对更好地监管互联网，

because users have consented to the terms and conditions.

因为用户已经同意了这些条款和条件。

As we've shown with this experiment,

正如我们在这个实验中展示的，

achieving informed consent is close to impossible.

获得知情同意几乎是不可能的。

Do you think it's fair to put the burden of responsibility on the consumer?

你认为让消费者承担责任是公平的吗？

I don't.

我不认同。

I think we should demand less take-it-or-leave-it

我认为我们应该要求减少 要么接受要么放弃，

and more understandable terms before we agree to them.

在我们同意前给出更多可理解的条款。

(Applause)

（鼓掌）

Thank you.

谢谢。

Now, I would like to tell you a story about love.

现在我想讲一个关于爱的故事。

Some of the world's most popular apps are dating apps,

一些世界上最流行的应用是相亲应用，

an industry now worth more than, or close to, three billion dollars a year.

这个行业现在价值超过 或接近，一年30亿美元。

And of course, we're OK sharing our intimate details

当然，我们可以与另一半

with our other half.

分享我们的私密细节。

But who else is snooping,

但当我们在坦白灵魂时，

saving and sharing our information

还有谁在窥探，保存和

while we are baring our souls?

分享我们的信息呢？

My team and I decided to investigate this.

我和团队打算对此展开调查。

And in order to understand the issue from all angles

为了从各个角度了解这个问题

and to truly do a thorough job,

并认真做好工作，

I realized I had to download

我意识到我得亲自下载

one of the world's most popular dating apps myself.

一款世界上最流行的相亲软件。

So I went home to my wife ...

所以我回家问我老婆…

(Laughter)

（笑声）

who I had just married.

我们刚结婚不久。

"Is it OK if I establish a profile on a very popular dating app

“纯粹为了科学研究，我可以在 一个非常流行的相亲软件上

for purely scientific purposes?"

建立个人档案吗？”

(Laughter)

（笑声）

This is what we found.

于是我们发现了这个。

Hidden behind the main menu was a preticked box

隐藏在主菜单后面的 是一个预先标记好的格子，

that gave the dating company access to all my personal pictures on Facebook,

让这个相亲公司可以获取 我在Facebook上的所有个人照片，

in my case more than 2,000 of them,

我个人有超过2千张照片，

and some were quite personal.

其中有些相当私密。

And to make matters worse,

并且更糟糕的是，

when we read the terms and conditions,

当我阅读条款时，

we discovered the following,

我们发现了下面的内容，

and I'm going to need to take out my reading glasses for this one.

我需要掏出老花镜才能看清。

And I'm going to read it for you, because this is complicated.

我打算给大家阅读一下，因为太复杂了。

All right.

好的。

"By posting content" --

“发布内容”——

and content refers to your pictures, chat

内容指你的照片，聊天记录

and other interactions in the dating service --

和其他在相亲服务上的互动——

"as a part of the service,

“作为服务的一部分，

you automatically grant to the company,

你自动授予公司，

its affiliates, licensees and successors

及其关联方，被许可方或继任公司

an irrevocable" -- which means you can't change your mind --

不可撤销，”——意思是你不能改变主意——

"perpetual" -- which means forever --

“永久的”——意思是永远——

"nonexclusive, transferrable, sublicensable, fully paid-up,

“非排他、可转让、可附带许可、完全付费、

worldwide right and license to use, copy, store, perform,

在全球范围内的使用、复制、存储、执行、

display, reproduce, record,

显示、复制、录制、

play, adapt, modify and distribute the content,

播放、改编、修改和分发内容

prepare derivative works of the content,

以及内容的派生作品的权利和许可，

or incorporate the content into other works

或将内容合并到其他作品中，

and grant and authorize sublicenses of the foregoing in any media

并在任何已知或以后创建的媒体中授予

now known or hereafter created."

和授权上述转授许可。”

That basically means that all your dating history

这基本上意味着你所有的相亲历史

and everything related to it can be used for any purpose for all time.

以及任何与之有关的一切东西 可以一直被用于任何目的。

Just imagine your children seeing your sassy dating photos

想象一下，你的孩子 在20年后的节育广告中

in a birth control ad 20 years from now.

会看到你时髦的约会照。

But seriously, though --

但说真的——

(Laughter)

（笑声）

what might these commercial practices mean to you?

这些商业惯例对你意味着什么？

For example, financial loss:

比如，财务损失：

based on your web browsing history,

基于你的网站浏览历史，

algorithms might decide whether you will get a mortgage or not.

算法可能决定你能否该获得贷款。

Subconscious manipulation:

潜意识操纵：

companies can analyze your emotions based on your photos and chats,

公司可以通过你的照片 和聊天分析你的情绪，

targeting you with ads when you are at your most vulnerable.

在你最脆弱时投放针对你的定向广告。

Discrimination:

歧视：

a fitness app can sell your data to a health insurance company,

健身应用可以把你的 数据卖给健康保险公司，

preventing you from getting coverage in the future.

让你将来获得保险困难重重。

All of this is happening in the world today.

所有这一切都发生在今天的世界中。

But of course, not all uses of data are malign.

但当然，并非所有的 数据使用都是有害的。

Some are just flawed or need more work,

有些只是缺陷，或者需要更多的工作，

and some are truly great.

有些则真的很棒。

And there is some good news as well.

这里也有一些好消息。

The dating companies changed their policies globally

在我们提出诉讼后，这个交友公司

after we filed a legal complaint.

改变了他们的全球政策。

But organizations such as mine

但像我们这样

that fight for consumers' rights can't be everywhere.

为消费者权益斗争的 组织不是到处都有。

Nor can consumers fix this on their own,

消费者也无法独自修复这个问题，

because if we know that something innocent we said

因为假如我们知道 我们的一些无心之言

will come back to haunt us,

会反过来困扰我们，

we will stop speaking.

我们就会停止发声。

If we know that we are being watched and monitored,

如果我们知道自己正在被关注和监控，

we will change our behavior.

就会改变自身的行为。

And if we can't control who has our data and how it is being used,

如果我们无法控制谁拥有 我们的数据，以及数据如何被使用，

we have lost the control of our lives.

我们就失去了对自己生活的控制。

The stories I have told you today are not random examples.

我今天告诉你们的故事 并不是随机的案例。

They are everywhere,

它们无处不在，

and they are a sign that things need to change.

它们标志着是时候该改变现状了。

And how can we achieve that change?

我们如何才能实现这种改变？

Well, companies need to realize that by prioritizing privacy and security,

公司需要认识到应该以隐私和安全为先，

they can build trust and loyalty to their users.

在此基础上培养用户的信任和忠诚。

Governments must create a safer internet

政府必须通过监督执行和更新规则

by ensuring enforcement and up-to-date rules.

去构建一个更安全的互联网。

And us, the citizens?

而我们这些公民呢？

We can use our voice

我们可以用自己的声音

to remind the world that technology can only truly benefit society

去提醒世界，科技只有 在尊重基本权利的基础上，

if it respects basic rights.

才能真正让全社会受益。

Thank you so much.

谢谢大家。

(Applause)

（鼓掌）