How the NSA betrayed the world's trust -- time to act | Mikko Hypponen

翻译人员: Calvin Hsu 校对人员: Wu Di

The two most likely largest inventions

互联网和手机可以说是

of our generation

我们这个时代

are the Internet and the mobile phone.

最为重要的两大发明了

They've changed the world.

它们改变了整个世界

However, largely to our surprise,

然而，令我们非常吃惊的是

they also turned out to be the perfect tools

它们同时也成为了

for the surveillance state.

用于国家监视的完美工具

It turned out that the capability

事实上，收集关于我们

to collect data, information and connections

每个人或者说所有人的

about basically any of us and all of us

数据、信息以及关系的这种能力

is exactly what we've been hearing

正是这个夏天从

throughout of the summer through revelations and leaks

西方情报机构

about Western intelligence agencies,

特别是美国情报机构

mostly U.S. intelligence agencies,

所透露或者泄露的

watching over the rest of the world.

这些情报机构监视着世界其它地方

We've heard about these starting with the

六月六日开始

revelations from June 6.

陆续听到一些泄露的消息

Edward Snowden started leaking information,

斯诺登开始透露

top secret classified information,

那些来源于美国情报机构的

from the U.S. intelligence agencies,

顶级机密信息

and we started learning about things like PRISM

于是我们也开始了解到一些

and XKeyscore and others.

诸如菱镜计划和XKeyscore的事情

And these are examples of the kinds of programs

这些都是美国情报机构

U.S. intelligence agencies are running right now,

正在运作的项目

against the whole rest of the world.

以此对抗世界其它国家

And if you look back about the forecasts

如果你回顾一下乔治·奥威尔

on surveillance by George Orwell,

有关监视的预言

well it turns out that

你会发现

George Orwell was an optimist.

奥威尔的确是一个乐观主义者

(Laughter)

(笑声)

We are right now seeing a much larger scale

如今我们看到的是大规模的

of tracking of individual citizens

对普通民众的跟踪

than he could have ever imagined.

这远远超出了他最初的想象

And this here is the infamous

这就是那个臭名昭著的

NSA data center in Utah.

美国犹他州的NSA数据中心

Due to be opened very soon,

在不久的将来开放后

it will be both a supercomputing center

它将成为一个超级计算中心

and a data storage center.

同时也将成为一个超大数据中心

You could basically imagine it has a large hall

你几乎可以想象那个被硬盘设备塞满的大厅

filled with hard drives storing data

无时不刻都在存储

they are collecting.

他们收集来的数据

And it's a pretty big building.

这是一幢巨大的建筑

How big? Well, I can give you the numbers --

具体有多大呢？我们来看一个数据

140,000 square meters --

14万平方米

but that doesn't really tell you very much.

可能你对这个数据也没有太多概念

Maybe it's better to imagine it as a comparison.

我们最好通过比较来想象

You think about the largest IKEA store

想想你去过的

you've ever been in.

最大的宜家家具吧

This is five times larger.

它将是宜家的五倍大

How many hard drives can you fit in an IKEA store?

想想你能在宜家塞进多少硬盘设备吧

Right? It's pretty big.

是吧？数目的确非常巨大！

We estimate that just the electricity bill

我们估算仅用于运行

for running this data center

这个数据中心的电费

is going to be in the tens of millions of dollars a year.

每年就需要数千万美元

And this kind of wholesale surveillance

而这种大规模的监视

means that they can collect our data

意味着他们可以收集我们的数据

and keep it basically forever,

并且基本上可以永久保留

keep it for extended periods of time,

保留很长时间

keep it for years, keep it for decades.

几年甚至几十年

And this opens up completely new kinds of risks

这个将给我们所有人

to us all.

带来前所未有的风险

And what this is is that it is wholesale

它将是一种大规模的对我们每个人的

blanket surveillance on everyone.

无障碍监视

Well, not exactly everyone,

当然，确切来说也不是对所有人

because the U.S. intelligence only has a legal right

因为美国情报机构只有对外国人的

to monitor foreigners.

合法监视权力

They can monitor foreigners

一旦那些非美国的数据流

when foreigners' data connections

到达或者经过美国

end up in the United States or pass through the United States.

就要被监视了

And monitoring foreigners doesn't sound too bad

监视外国人听起来似乎没那么糟糕

until you realize

除非你意识到

that I'm a foreigner and you're a foreigner.

其实我们都是老外

In fact, 96 percent of the planet are foreigners.

事实上，这个星球上96%都是老外

(Laughter)

(笑)

Right?

是吧？

So it is wholesale blanket surveillance of all of us,

所以说只要你使用通信工具和互联网

all of us who use telecommunications and the Internet.

你就会被彻底监视

But don't get me wrong:

大家也别误会

There are actually types of surveillance that are okay.

的确也有一些还不错的监视形式

I love freedom, but even I agree

我热爱自由，但我自始至终也同意

that some surveillance is fine.

有一些监视是有益的

If the law enforcement is trying to find a murderer,

比如如果执法机关正在寻找一名谋杀犯

or they're trying to catch a drug lord

或者搜捕一个贩毒者

or trying to prevent a school shooting,

或者试图阻止一场校园枪击案的发生

and they have leads and they have suspects,

并且他们中有头目有嫌疑犯

then it's perfectly fine for them to tap the suspect's phone,

此时如果能监听他们的手机

and to intercept his Internet communications.

截获他们的网络通信那就太棒了

I'm not arguing that at all,

我并不反对这一点

but that's not what programs like PRISM are about.

但菱镜计划之类的项目并不是这么做的

They are not about doing surveillance on people

他们不是在监视那些

that they have reason to suspect of some wrongdoings.

他们有理由怀疑的坏人

They're about doing surveillance on people

他们在监视那些

they know are innocent.

无辜的人

So the four main arguments

对于这样的监听

supporting surveillance like this,

有四条主要的理由

well, the first of all is that whenever you start

首先是只要你

discussing about these revelations,

一开始讨论信息泄露的问题

there will be naysayers trying to minimize

总会有反对者站出来

the importance of these revelations, saying that

把泄露的重要性降到最小

we knew all this already,

他们说我们早已知道这些

we knew it was happening, there's nothing new here.

我们知道在发生什么，没有什么新鲜的

And that's not true. Don't let anybody tell you

事实不是这样的

that we knew this already, because we did not know this already.

谁说我们早知道这些？我们不知道

Our worst fears might have been something like this,

我们最大的恐惧就是这些事情已经发生

but we didn't know this was happening.

而我们一无所知

Now we know for a fact it's happening.

现在我们的确可以确定的知道在发生什么

We didn't know about this. We didn't know about PRISM.

而我们之前并不了解 我们不了解PRISM

We didn't know about XKeyscore. We didn't know about Cybertrans.

也不了解XKeyscore，Cybertrans

We didn't know about DoubleArrow.

还有DoubleArrow

We did not know about Skywriter --

以及Skywriter

all these different programs

这些各式各样

run by U.S. intelligence agencies.

由美国情报局运行的项目

But now we do.

但现在我们都了解了

And we did not know

我们之前也并不知道

that U.S. intelligence agencies go to extremes

美国情报机构如何极端到

such as infiltrating standardization bodies

通过渗透至标准组织内部

to sabotage encryption algorithms on purpose.

以达到削弱加密算法强度的目的

And what that means

这就意味着

is that you take something which is secure,

如果你拿到一份加密文件

an encryption algorithm which is so secure

它的加密算法可以安全到

that if you use that algorithm to encrypt one file,

使你加密之后

nobody can decrypt that file.

没有任何人可以解开它

Even if they take every single computer on the planet just to decrypt that one file,

即便你用地球上的每一个计算机去解密它

it's going to take millions of years.

也需要数百万年

So that's basically perfectly safe, uncrackable.

它可以说是绝密的，无懈可击

You take something which is that good

拿到这样一件完美的东西

and then you weaken it on purpose,

然后故意弱化它

making all of us less secure as an end result.

使得我们每个人终都变得不安全

A real-world equivalent would be that

现实生活中一个类似的例子是

intelligence agencies would force

情报机构会强行

some secret pin code into every single house alarm

将某种加密识别码植入每个家居防盗系统

so they could get into every single house

这样他们就可以进入任何一所房子

because, you know, bad people might have house alarms,

因为坏人可能装有防盗系统

but it will also make all of us

但这样一来

less secure as an end result.

最后我们自己也变得不那么安全

Backdooring encryption algorithms

利用加密算法这个后门儿

just boggles the mind.

的确让人匪夷所思

But of course, these intelligence agencies are doing their job.

当然啦，这些情报机构只是在履行自己的职责

This is what they have been told to do:

这正是他们被要求做的事情

do signals intelligence,

做信号情报

monitor telecommunications,

监视通讯渠道

monitor Internet traffic.

以及监测网络流量

That's what they're trying to do,

这正是他们尝试在做的

and since most, a very big part of the Internet traffic today is encrypted,

由于目前相当大一部分的互联网流量是加密的

they're trying to find ways around the encryption.

他们也就在尝试通过加密寻找突破口

One way is to sabotage encryption algorithms,

削弱加密算法就是其中一种手段

which is a great example

这是美国情报机构如何

about how U.S. intelligence agencies

为所欲为

are running loose.

的一个极好的例子

They are completely out of control,

他们完全不受控制

and they should be brought back under control.

而这些应该加以控制

So what do we actually know about the leaks?

而我们对这些信息泄露的真实了解能有多少呢

Everything is based on the files

所有这些都基于

leaked by Mr. Snowden.

Snowden先生的那些泄露文件

The very first PRISM slides

从六月初

from the beginning of June

第一个PRISM的幻灯片开始

detail a collection program where the data

它详细描述了

is collected from service providers,

一个从服务提供商收集数据的项目

and they actually go and name the service providers

而且他们还对那些被使用的

they have access to.

服务商进行了命名

They even have a specific date

甚至为他们设立一个纪念日

on when the collection of data began

记载开始从各个服务提供商

for each of the service providers.

获取数据的日子

So for example, they name the collection from Microsoft

比如，他们为2007年9月11号

started on September 11, 2007,

开始从Microsoft获取的那批数据起了名字

for Yahoo on the March 12, 2008,

还有2008年3月12号的Yahoo

and then others: Google, Facebook,

之后还有Google, Facebook

Skype, Apple and so on.

Skype, Apple等等

And every single one of these companies denies.

任何一个公司对此都呈否认态度

They all say that this simply isn't true,

都说这简直就是谎言

that they are not giving backdoor access to their data.

他们从来没有开过后门让别人获取他们的数据

Yet we have these files.

但是我们的确得到了这些文件

So is one of the parties lying,

那么是其中一方在撒谎吗？

or is there some other alternative explanation?

有没有其他可能的解释？

And one explanation would be

一种可能的解释是

that these parties, these service providers,

这些当事人，也就是这些服务提供商

are not cooperating.

他们并没有合作

Instead, they've been hacked.

只是被黑了

That would explain it. They aren't cooperating. They've been hacked.

这种解释是合理的：他们没有参与而是受到了黑客攻击

In this case, they've been hacked by their own government.

其实可以说是他们被自己的政府黑了

That might sound outlandish,

也许这听起来有点荒唐

but we already have cases where this has happened,

但我们的确有过这样的案例

for example, the case of the Flame malware

比如那个有关恶意软件Flame的案子

which we strongly believe was authored

我们之前多么坚信它是由

by the U.S. government,

美国政府授权的

and which, to spread, subverted the security

而就是它破坏了Windows的

of the Windows Update network,

网络升级系统的安全

meaning here, the company was hacked

这就意味着

by their own government.

他们被自己的政府黑了

And there's more evidence

当然还有更多

supporting this theory as well.

支撑这个说法的证据

Der Spiegel, from Germany, leaked more information

德国的明镜周刊（Der Spiegel）暴露了更多

about the operations run by the elite hacker units

有关这些情报机构中的顶级黑客团队

operating inside these intelligence agencies.

所做作为的信息

Inside NSA, the unit is called TAO,

在NSA内部, 这个部门被叫做TAO

Tailored Access Operations,

特定情报获取行动

and inside GCHQ, which is the U.K. equivalent,

这个等同于英国GCHQ内部的NAC

it's called NAC, Network Analysis Centre.

网络分析中心（Network Analysis Centre）

And these recent leaks of these three slides

最近泄露的这三个幻灯片

detail an operation

详细描述了一个由GCHQ情报局

run by this GCHQ intelligence agency

在英国发起的行动

from the United Kingdom

目标定位在

targeting a telecom here in Belgium.

一个比利时的电信公司

And what this really means

这件事表明了一个事实

is that an E.U. country's intelligence agency

一个欧盟国家的情报机构

is breaching the security

正在蓄意破坏

of a telecom of a fellow E.U. country on purpose,

联盟国家电信公司的安全

and they discuss it in their slides completely casually,

而他们在幻灯片里谈论这件事时

business as usual.

一如既往的自然

Here's the primary target,

这是主要目标

here's the secondary target,

这是次要目标

here's the teaming.

这是他们的团队

They probably have a team building on Thursday evening in a pub.

他们通常会在周四晚上在酒吧里做团队建设的活动

They even use cheesy PowerPoint clip art

他们每成功一次

like, you know, "Success,"

就会用一些俗气的幻灯片

when they gain access to services like this.

庆祝所谓的胜利

What the hell?

他们究竟在搞什么鬼

And then there's the argument

有人会争辩说

that okay, yes, this might be going on,

是的，他们是在监视

but then again, other countries are doing it as well.

但话说回来，哪个国家没有这样的行动呢？

All countries spy.

也许真的是

And maybe that's true.

所有国家都有间谍

Many countries spy, not all of them, but let's take an example.

很多国家都有，但并不是所有都是这样

Let's take, for example, Sweden.

比如说，瑞典

I'm speaking of Sweden because Sweden

我提起瑞典这个国家是因为

has a little bit of a similar law to the United States.

在法律方面它与美国是有些相似的

When your data traffic goes through Sweden,

当你的数据流经过瑞典的时候

their intelligence agency has a legal right by the law

他们的情报机构的确是有

to intercept that traffic.

截获这些数据的合法权力

All right, how many Swedish decisionmakers

那么，有多少瑞典的决策者

and politicians and business leaders

政治家和商业领袖

use, every day, U.S.-based services,

每天使用美国的服务呢？

like, you know, run Windows or OSX,

比如像使用Windows或OSX

or use Facebook or LinkedIn,

使用Facebook或LinkedIn

or store their data in clouds like iCloud

或者将数据上传到类似iCloud中进行云存储

or Skydrive or DropBox,

还有Skydrive或者DropBox

or maybe use online services like Amazon web services or sales support?

也许还有一些在线服务，类似Amazon网络服务或者销售支持？

And the answer is, every single Swedish business leader does that every single day.

答案是，每一个瑞典的商业人士每天都会使用它们

And then we turn it around.

那么如果我们反过来问

How many American leaders

有多少美国杰出人士

use Swedish webmails and cloud services?

使用瑞典的网络邮箱和云服务呢？

And the answer is zero.

答案是零

So this is not balanced.

所以这显然是不平衡的

It's not balanced by any means, not even close.

相差甚远

And when we do have the occasional

即使有一天我们偶然发现一个

European success story,

欧洲人获胜的故事

even those, then, typically end up being sold to the United States.

典型的结局一定是这个服务被美国公司收购

Like, Skype used to be secure.

比如，Skype最初采用端到端的加密

It used to be end-to-end encrypted.

所以还是安全的

Then it was sold to the United States.

后来被卖给了美国后

Today, it no longer is secure.

就不再安全了

So once again, we take something which is secure

所以，我们再一次把一个原本安全的东西

and then we make it less secure on purpose,

弄得不再安全

making all of us less secure as an outcome.

使得我们所有人最终也都不再安全了

And then the argument that the United States

也有争论说

is only fighting terrorists.

美国只是在

It's the war on terror.

展开一场针对恐怖分子的战争

You shouldn't worry about it.

本来无需担忧

Well, it's not the war on terror.

但事实上它不是

Yes, part of it is war on terror, and yes,

是的，我们承认这中间有恐怖分子

there are terrorists, and they do kill and maim,

我们必须与这些

and we should fight them,

肆意残害的行为作战

but we know through these leaks

但从那些泄露的消息中我们也知道

that they have used the same techniques

他们在使用相同的手段

to listen to phone calls of European leaders,

监听那些欧洲的领导者

to tap the email of residents of Mexico and Brazil,

截获墨西哥和巴西居民的邮件

to read email traffic inside the United Nations Headquarters and E.U. Parliament,

甚至联合国总部以及欧盟议会的邮件

and I don't think they are trying to find terrorists

他们显然不会在欧盟议会内部

from inside the E.U. Parliament, right?

寻找恐怖分子，对吧？

It's not the war on terror.

所以，这不是一场针对恐怖分子的战争

Part of it might be, and there are terrorists,

虽然部分意义上可以说是

but are we really thinking about terrorists

恐怖主义的确是存在的

as such an existential threat

但我们会认为它是一种

that we are willing to do anything at all to fight them?

必需我们不惜一切代价去全力对抗的现存威胁么？

Are the Americans ready to throw away the Constituion

美国人民准备为了恐怖分子

and throw it in the trash just because there are terrorists?

而抛弃宪法？

And the same thing with the Bill of Rights and all the amendments

抛弃那些人权法案？

and the Universal Declaration of Human Rights

还有世界人权宣言

and the E.U. conventions on human rights and fundamental freedoms

欧盟那些关于人权和基本自由的法案

and the press freedom?

还有出版自由？

Do we really think terrorism is such an existential threat,

我们真的认为恐怖主义

we are ready to do anything at all?

需要我们不惜这一切代价吗？

But people are scared about terrorists,

是的，人们惧怕恐怖主义

and then they think that maybe that surveillance is okay

所以也许他们认为这样的监视是合理的

because they have nothing to hide.

反正也没什么需要隐藏的

Feel free to survey me if that helps.

需要的话那就随便监视好了

And whoever tells you that they have nothing to hide

但是，谁说他们没有什么值得隐藏起来的？

simply hasn't thought about this long enough.

只是他们还没有考虑那么长远罢了

(Applause)

(掌声)

Because we have this thing called privacy,

因为我们每个人都有隐私

and if you really think that you have nothing to hide,

如果你真的认为你没有什么要隐藏的

please make sure that's the first thing you tell me,

那你一定要弄清楚这是你告诉我的第一件事

because then I know

因为这之后我会觉得

that I should not trust you with any secrets,

不能再信任你

because obviously you can't keep a secret.

因为你明显不会保守秘密

But people are brutally honest with the Internet,

人们对互联网都表现出盲目的诚实

and when these leaks started,

当那些信息开始泄露的时候

many people were asking me about this.

许多人问我

And I have nothing to hide.

说他们没有什么需要隐瞒的

I'm not doing anything bad or anything illegal.

也没有做什么坏事或者违法的事情

Yet, I have nothing that I would in particular

而且我也没有什么想要与

like to share with an intelligence agency,

情报中心分享的特殊信息

especially a foreign intelligence agency.

何况还是国外的情报机构

And if we indeed need a Big Brother,

就算我们真的需要一个老大

I would much rather have a domestic Big Brother

我也希望他是本国的

than a foreign Big Brother.

而不是来自国外

And when the leaks started, the very first thing I tweeted about this

当信息泄露开始的时候，我最先发表的

was a comment about how,

一条评论就是关于

when you've been using search engines,

当人们使用搜索引擎时，

you've been potentially leaking all that to U.S. intelligence.

是如何将信息泄露给了美国情报机构

And two minutes later, I got a reply

两分钟后我收到一条回复

by somebody called Kimberly from the United States

来自一个叫做Kimberly的美国人

challenging me, like, why am I worried about this?

他反对我说

What am I sending to worry about this? Am I sending naked pictures or something?

我又没有发送裸照之类的东西，为什么我还需要担心这个？

And my answer to Kimberly was

我回答他说

that what I'm sending is none of your business,

我发送什么与你无关

and it should be none of your government's business either.

当然也与你的政府无关

Because that's what it's about. It's about privacy.

因为这就是隐私

Privacy is nonnegotiable.

这一点没什么好讨论的

It should be built in to all the systems we use.

就是应该在我们所用的所有系统得到保障

(Applause)

(鼓掌)

And one thing we should all understand

有一点我们需要知道的是

is that we are brutally honest with search engines.

我们对搜索引擎也是在盲目信任

You show me your search history,

只要你透露了你的搜索记录

and I'll find something incriminating

我就能在五分钟之内

or something embarrassing there in five minutes.

找到那些与之关联的让人尴尬的东西

We are more honest with search engines

我们对搜索引擎的诚实

than we are with our families.

常常多于对我们的家庭

Search engines know more about you

搜索引擎通常也比你的家人

than your family members know about you.

更了解你

And this is all the kind of information we are giving away,

这就是那些我们

we are giving away to the United States.

泄露给美国的信息

And surveillance changes history.

监视改变历史

We know this through examples of corrupt presidents like Nixon.

堕落总统Nixon之类的例子告诉我们这些

Imagine if he would have had the kind of surveillance tools that are available today.

想象下如果他当时有现在这样的情报收集工具会怎么样吧

And let me actually quote

我想用巴西总统Dilma Rousseff夫人

the president of Brazil, Ms. Dilma Rousseff.

做个例子

She was one of the targets of NSA surveillance.

她就是NSA监视的对象之一

Her email was read, and she spoke

她的邮件被截获了

at the United Nations Headquarters, and she said,

她曾经在联合国总部质问

"If there is no right to privacy,

“如果没有隐私的权利

there can be no true freedom of expression and opinion,

就不会有什么真正的言论自由和舆论自由

and therefore, there can be no effective democracy."

因此也不可能有有效的民主”

That's what it's about.

就是这样

Privacy is the building block of our democracies.

隐私是民主的基础

And to quote a fellow security researcher, Marcus Ranum,

一名在安全方面的同行学者Marcus Ranum曾说

he said that the United States is right now treating the Internet

如今美国对互联网的态度

as it would be treating one of its colonies.

就像对待他们的殖民地

So we are back to the age of colonization,

所以我们已经又回到了殖民时代

and we, the foreign users of the Internet,

我们这些互联网的外国用户

we should think about Americans as our masters.

应该把美国当做自己的主人

So Mr. Snowden, he's been blamed for many things.

Snowden先生曾经受到过种种指责

Some are blaming him for causing problems

有些人谴责他带来了美国云产业

for the U.S. cloud industry and software companies with these revelations --

和软件公司的信息泄露问题

and blaming Snowden for causing problems for the U.S. cloud industry

而这些谴责就如同

would be the equivalent of blaming Al Gore

在责备Al Gore

for causing global warming.

带来全球变暖问题一样

(Laughter)

(笑)

(Applause)

(鼓掌)

So, what is there to be done?

那么，我们该怎么办？

Should we worry. No, we shouldn't worry.

我们需要担忧吗？不

We should be angry, because this is wrong,

我们应该为这些丑恶的、无礼的、不该发生的事情

and it's rude, and it should not be done.

而愤怒

But that's not going to really change the situation.

但这些对改变现实无济于事

What's going to change the situation for the rest of the world

对于世界其它国家来说解决这一问题的方法

is to try to steer away

就是尝试避开

from systems built in the United States.

美国建立的这些系统

And that's much easier said than done.

但这说起来容易做起来难

How do you do that?

该怎么做呢

A single country, any single country in Europe

任何一个欧洲国家

cannot replace and build replacements

都没有能力替代

for the U.S.-made operating systems and cloud services.

美国制造的操作系统和云服务

But maybe you don't have to do it alone.

但也许我们可以不用孤军奋战

Maybe you can do it together with other countries.

而是与其它国家联合

The solution is open source.

这个解决方案是开源的

By building together open, free, secure systems,

通过一同构建这样一个开放、免费并安全的系统

we can go around such surveillance,

我们可以绕开监视

and then one country doesn't have to solve the problem by itself.

并且每个国家都不再只靠自己的力量

It only has to solve one little problem.

而只需要解决一个小问题

And to quote a fellow security researcher, Haroon Meer,

我们的安全专家Haroon Meer说过

one country only has to make a small wave,

每个国家都只能成为一个小水波

but those small waves together become a tide,

而聚在一起就可以掀起巨浪

and the tide will lift all the boats up at the same time,

从而可以同时载起所有的小船

and the tide we will build

这个安全，免费并开源的系统

with secure, free, open-source systems,

将成为推动我们所有人的彭波巨浪

will become the tide that will lift all of us

使我们可以从此

up and above the surveillance state.

彻底逃脱国家的监视

Thank you very much.

谢谢大家

(Applause)

(鼓掌)