How tech companies deceive you into giving up your data and privacy | Finn Lützow-Holm Myrstad

譯者: Lilian Chiu 審譯者: Yanyan Hong

Do you remember when you were a child,

你是否記得，在小時候，

you probably had a favorite toy that was a constant companion,

你可能有個最愛的玩具， 總是陪在你身邊，

like Christopher Robin had Winnie the Pooh,

就像克里斯多夫羅賓和維尼熊，

and your imagination fueled endless adventures?

且你的想像力創造出了 無盡的冒險旅程？

What could be more innocent than that?

還有什麼比那更純真的？

Well, let me introduce you to my friend Cayla.

讓我介紹我的朋友 凱拉給各位認識。

Cayla was voted toy of the year in countries around the world.

凱拉是全世界各國 票選出來的年度玩具。

She connects to the internet and uses speech recognition technology

她能連上網路，使用聲音辨識技術

to answer your child's questions,

來回答你的孩子問的問題，

respond just like a friend.

就像個朋友一樣做出回應。

But the power doesn't lie with your child's imagination.

但力量並不是來自 你的孩子的想像力。

It actually lies with the company harvesting masses of personal information

力量是來自背後的公司

取得你的家人在安全的家中

while your family is innocently chatting away in the safety of their home,

很無心地從聊天中釋出的 大量個人資料，

a dangerously false sense of security.

這是一種很危險的虛假安全感。

This case sounded alarm bells for me,

這個案例讓我有所警戒，

as it is my job to protect consumers' rights in my country.

因為我的工作就是要保護 國內消費者的權益。

And with billions of devices such as cars,

預計在 2020 年， 有數十億種裝置都會上網，

energy meters and even vacuum cleaners expected to come online by 2020,

包括汽車、電度錶， 甚至真空吸塵器，

we thought this was a case worth investigating further.

因此，我們認為這個案例 值得進一步調查。

Because what was Cayla doing

因為，凱拉知道了這麼多

with all the interesting things she was learning?

有趣的資訊之後，會拿來做什麼？

Did she have another friend she was loyal to and shared her information with?

她還對另一位朋友忠誠， 且會分享資訊給他嗎？

Yes, you guessed right. She did.

是的，你猜對了，就是這樣。

In order to play with Cayla,

如果要和凱拉玩，

you need to download an app to access all her features.

你就必須要下載一個應用程式 來使用她的特色功能。

Parents must consent to the terms being changed without notice.

父母必須要同意一些條款， 這些條款有改變時不會通知。

The recordings of the child, her friends and family,

孩子、孩子的朋友 及家人被錄下的對話

can be used for targeted advertising.

可以被用來做精準廣告投放。

And all this information can be shared with unnamed third parties.

所有這些資訊都可以 和不知名的第三方分享。

Enough? Not quite.

夠了嗎？還不只如此。

Anyone with a smartphone can connect to Cayla

任何有智慧手機的人，

都可以在一定的距離內 和凱拉連線。

within a certain distance.

When we confronted the company that made and programmed Cayla,

我們質問製造凱拉 和為她設計程式的公司，

they issued a series of statements

他們發佈了一系列的聲明，

that one had to be an IT expert in order to breach the security.

宣稱只有資訊科技專家 才有可能危及其安全性。

Shall we fact-check that statement and live hack Cayla together?

我們應該要驗證這個聲明，

同時在現場駭入凱拉的系統嗎？

Here she is.

這就是她。

Cayla is equipped with a Bluetooth device

凱拉有內建藍芽裝置，

which can transmit up to 60 feet,

傳輸距離是 60 英呎，

a bit less if there's a wall between.

如果有牆壁阻隔的話， 距離會再短一點。

That means I, or any stranger, can connect to the doll

那就表示，我，或任何陌生人，

能和凱拉娃娃連線，

while being outside the room where Cayla and her friends are.

就算不和凱拉及她的朋友 在同一房間中。

And to illustrate this,

為了說明這一點，

I'm going to turn Cayla on now.

我現在要把凱拉啟動。

Let's see, one, two, three.

咱們來看看，一、二、三。

There. She's on. And I asked a colleague

好了，她開機了。

我請個同事帶著智慧手機站在外面，

to stand outside with his smartphone,

and he's connected,

他連線了，

and to make this a bit creepier ...

還可以再做到更毛骨悚然一點……

(Laughter)

（笑聲）

let's see what kids could hear Cayla say in the safety of their room.

咱們來看看孩子們在安全的房間中

能聽到凱拉說什麼。

Man: Hi. My name is Cayla. What is yours?

男子：嗨，我是凱拉， 你叫什麼名字？

Finn Myrstad: Uh, Finn.

芬恩默斯塔：呃，芬恩。

Man: Is your mom close by?

男子：你媽媽在附近嗎？ 芬恩：不在，她在店裡。

FM: Uh, no, she's in the store.

Man: Ah. Do you want to come out and play with me?

男子：啊。你想要出來跟我玩嗎？

FM: That's a great idea.

芬：好主意。

Man: Ah, great.

男子：啊，太好了。

FM: I'm going to turn Cayla off now.

芬恩：現在我要把凱拉關機了。

(Laughter)

（笑聲）

We needed no password

我們不需要密碼，

or to circumvent any other type of security to do this.

也不用規避任何其他 安全機制就能做到這樣。

We published a report in 20 countries around the world,

我們在全世界二十個國家 刊出了一篇報導，

exposing this significant security flaw

揭露出這項重大的安全瑕疵，

and many other problematic issues.

以及許多其他有問題的議題。

So what happened?

所以，結果呢？

Cayla was banned in Germany,

德國下了對凱拉的禁令，

taken off the shelves by Amazon and Wal-Mart,

亞馬遜和沃爾瑪都將它全面下架，

and she's now peacefully resting

現在，她很安詳地在柏林的

at the German Spy Museum in Berlin.

德國間諜博物館中長眠。

(Laughter)

（笑聲）

However, Cayla was also for sale in stores around the world

然而，在我們的報告刊出之後， 有超過一年的時間，

for more than a year after we published our report.

在全世界其餘的店家裏 仍然可以買到凱拉。

What we uncovered is that there are few rules to protect us

我們發現的是， 保護我們的規則非常少，

and the ones we have are not being properly enforced.

而存在的那些規則 又沒有被妥當執行。

We need to get the security and privacy of these devices right

在這些裝置進入市場之前，

我們得先把它們的 安全性和隱私性做好，

before they enter the market,

because what is the point of locking a house with a key

因為，如果任何人都能 透過連結的裝置來進入房子，

if anyone can enter it through a connected device?

那用鑰匙把房子鎖上又有什麼意義？

You may well think, "This will not happen to me.

你可能會想： 「這不會發生在我身上。

I will just stay away from these flawed devices."

我會和這些有瑕疵的 裝置保持距離。」

But that won't keep you safe,

但那並不表示你就是安全的，

because simply by connecting to the internet,

因為只要連上網路，

you are put in an impossible take-it-or-leave-it position.

你就被放在一個 「不要就拉倒」的困難位置上。

Let me show you.

讓我展示給各位看。

Like most of you, I have dozens of apps on my phone,

跟大部分人一樣，我的手機上 有一大堆應用程式，

and used properly, they can make our lives easier,

妥當使用它們可以讓生活更簡易、

more convenient and maybe even healthier.

更方便，可能還會更健康。

But have we been lulled into a false sense of security?

但我們是否被誤導入 一種虛假的安全感呢？

It starts simply by ticking a box.

一開始只是簡單的勾選動作。

Yes, we say,

是的，我們宣稱已閱讀過條款了。

I've read the terms.

But have you really read the terms?

但你真的閱讀過條款嗎？

Are you sure they didn't look too long

還是其實是：條款看來太長了，

and your phone was running out of battery,

你的手機快要沒電了，

and the last time you tried they were impossible to understand,

且上次你試著閱讀條款， 實在無法看懂，

and you needed to use the service now?

而你現在就需要用這項服務？

And now, the power imbalance is established,

權力的不平衡就這麼建立了，

because we have agreed to our personal information

因為我們已經同意讓個人資訊

being gathered and used on a scale we could never imagine.

被以我們永遠無法想像的 規模來收集和使用。

This is why my colleagues and I decided to take a deeper look at this.

這就是為什麼我和我同事 決定要深入了解這個狀況。

We set out to read the terms

我們開始閱讀一般手機上的

of popular apps on an average phone.

熱門應用程式的條款。

And to show the world how unrealistic it is

為了讓世界看到，

認為消費者會真的閱讀條款

to expect consumers to actually read the terms,

是多麼不切實際的期望，

we printed them,

我們便把條款印出來， 印了超過九百頁，

more than 900 pages,

and sat down in our office and read them out loud ourselves,

坐在辦公室中，自己大聲讀出來，

streaming the experiment live on our websites.

在我們的網站上直播這項實驗。

As you can see, it took quite a long time.

如各位所見，做這件事 花了好長的時間。

It took us 31 hours, 49 minutes and 11 seconds

我們花了 31 小時 49 分鐘 11 秒

to read the terms on an average phone.

才把一支一般手機上的條款讀完。

That is longer than a movie marathon of the "Harry Potter" movies

這比《哈利波特》系列 加上《教父》系列的

and the "Godfather" movies combined.

電影馬拉松都還要久。

(Laughter)

（笑聲）

And reading is one thing.

且，閱讀只是閱讀，

Understanding is another story.

並不等於了解了。

That would have taken us much, much longer.

了解要花的時間還要更長許多。

And this is a real problem,

這是個真實的問題，

because companies have argued for 20 to 30 years

因為，二三十年來， 企業一直提出理由

against regulating the internet better,

反對將網際網路做更好的規制，

because users have consented to the terms and conditions.

就是因為用戶已同意了條件和條款。

As we've shown with this experiment,

正如我們用這個實驗展示的，

achieving informed consent is close to impossible.

要做到真的知情同意，幾乎不可能。

Do you think it's fair to put the burden of responsibility on the consumer?

你們認為把責任的重擔 推給消費者是公平的嗎？

I don't.

我不認為。

I think we should demand less take-it-or-leave-it

我認為，我們應該要求 減少「不要就拉倒」，

and more understandable terms before we agree to them.

增加大家看得懂的條款， 然後我們才做出同意。

(Applause)

（掌聲）

Thank you.

謝謝。

Now, I would like to tell you a story about love.

接著，我要跟各位說 一個關於愛的故事。

Some of the world's most popular apps are dating apps,

有些世上最熱門的應用程式 是約會應用程式，

an industry now worth more than, or close to, three billion dollars a year.

目前這產業的年產值 約是三十億美金。

And of course, we're OK sharing our intimate details

當然，我們願意分享

我們的個人細節資訊 給自己的伴侶。

with our other half.

But who else is snooping,

但當我們在掏心掏肺 展露内心世界時，

saving and sharing our information

還有誰在窺探、儲存， 並分享我們的資訊？

while we are baring our souls?

My team and I decided to investigate this.

我和我的團隊決定要調查這件事。

And in order to understand the issue from all angles

為了從各角度了解這個議題，

and to truly do a thorough job,

並真正做到透徹完整，

I realized I had to download

我知道我自己必須要下載

one of the world's most popular dating apps myself.

世界上最熱門的約會 應用程式之一。

So I went home to my wife ...

所以我回家找我太太……

(Laughter)

（笑聲）

who I had just married.

我們才新婚。

"Is it OK if I establish a profile on a very popular dating app

「我可不可以在一個非常熱門的

約會應用程式上建立個人檔案，

for purely scientific purposes?"

單純是科學研究用途？」

(Laughter)

（笑聲）

This is what we found.

這是我們的發現。

Hidden behind the main menu was a preticked box

藏在主選單背後的， 是一個預先打勾的選項，

that gave the dating company access to all my personal pictures on Facebook,

打勾表示這間約會公司可以取得

我在臉書上的所有個人照片，

in my case more than 2,000 of them,

我臉書上的照片就有兩千張以上，

and some were quite personal.

有些真的是很私人的。

And to make matters worse,

更糟糕的是，

when we read the terms and conditions,

當我們閱讀條件與條款時， 我們有下列發現，

we discovered the following,

and I'm going to need to take out my reading glasses for this one.

這次我得要拿出我的閱讀眼鏡。

And I'm going to read it for you, because this is complicated.

我會唸給各位聽，因為這很複雜。

All right.

好。

"By posting content" --

「凡是張貼出內容」——

and content refers to your pictures, chat

內容指的是你的照片、聊天對話， 和約會服務上的其他互動——

and other interactions in the dating service --

"as a part of the service,

「做為服務的一部分， 就表示你自動允許本公司、

you automatically grant to the company,

its affiliates, licensees and successors

其附屬機構、授權者、繼承者 一項不可撤回的」——

an irrevocable" -- which means you can't change your mind --

意思是你不能改變心意——

"perpetual" -- which means forever --

「永久」——意思是永遠——

"nonexclusive, transferrable, sublicensable, fully paid-up,

「非獨家、可轉移、 可再授權、完全已付清、

worldwide right and license to use, copy, store, perform,

全球性的權利和許可， 可以使用、複製、儲存、演出、

display, reproduce, record,

展示、重製、記錄、播放、 改編、修改，及發行該內容，

play, adapt, modify and distribute the content,

製作該內容的衍生作品， 或把該內容整合到其他作品中，

prepare derivative works of the content,

or incorporate the content into other works

並允許和授權將上述許可

and grant and authorize sublicenses of the foregoing in any media

再授權給任何現在已知 或之後創造出的媒體。」

now known or hereafter created."

That basically means that all your dating history

基本上，意思就是你的 所有約會歷史記錄

and everything related to it can be used for any purpose for all time.

以及其相關的一切，

隨時都能被用在任何目的上。

Just imagine your children seeing your sassy dating photos

想像一下，

你的孩子在二十年後， 在生育控制廣告上

in a birth control ad 20 years from now.

看到你的狂野約會照片。

But seriously, though --

但，說真的——

(Laughter)

（笑聲）

what might these commercial practices mean to you?

這些商業的做法 對你而言有什麼意涵？

For example, financial loss:

比如，財務損失：

based on your web browsing history,

根據你的網頁瀏覽記錄，

algorithms might decide whether you will get a mortgage or not.

演算法可以決定 你是否能取得抵押借款。

Subconscious manipulation:

潛意識操控：

companies can analyze your emotions based on your photos and chats,

企業可以根據你的照片 和聊天對話來分析你的情緒，

targeting you with ads when you are at your most vulnerable.

在你腦波最弱的時候， 針對你做精準廣告投放。

Discrimination:

歧視：

a fitness app can sell your data to a health insurance company,

健身應用程式可以把你的資料 賣給健康保險公司，

preventing you from getting coverage in the future.

使你未來無法投保某些保險項目。

All of this is happening in the world today.

上述這些都是現今世界 正在發生的事。

But of course, not all uses of data are malign.

但，當然，並非所有的 資料使用都是惡意的。

Some are just flawed or need more work,

有些只是有瑕疵或是需要再改善，

and some are truly great.

有些真的很棒。

And there is some good news as well.

也有一些好消息。

The dating companies changed their policies globally

在我們提出法律投訴之後，

約會公司改變了它們全球的政策。

after we filed a legal complaint.

But organizations such as mine

但不可能到處都有像我的組織這種

that fight for consumers' rights can't be everywhere.

為消費者權益奮戰的組織。

Nor can consumers fix this on their own,

消費者也無法靠自己解決這個問題，

because if we know that something innocent we said

因為，如果知道我們無心說出的話

will come back to haunt us,

將來會回頭困擾我們， 我們就不會脫口而出了。

we will stop speaking.

If we know that we are being watched and monitored,

如果我們知道自己被監看、監視著，

we will change our behavior.

我們會改變我們的行為。

And if we can't control who has our data and how it is being used,

如果我們無法控制誰擁有我們的資料，

及資料會如何被使用，

we have lost the control of our lives.

我們就失去了我們人生的控制權。

The stories I have told you today are not random examples.

今天我告訴各位的故事 並不是隨機發生的例子。

They are everywhere,

它們處處可見，

and they are a sign that things need to change.

它們是一種徵兆， 表示改變是必要的。

And how can we achieve that change?

我們要如何達成那改變？

Well, companies need to realize that by prioritizing privacy and security,

企業必須要知道，

如果它們把隱私和安全性 列為優先事項，

they can build trust and loyalty to their users.

就能建立用戶的信任和忠誠度。

Governments must create a safer internet

政府必須通過確保執法和最新規則

by ensuring enforcement and up-to-date rules.

以創造更安全的網際網路。

And us, the citizens?

那我們公民呢？

We can use our voice

我們能發聲來提醒世界，

to remind the world that technology can only truly benefit society

科技若不能尊重基本權利，

if it respects basic rights.

就不可能真正讓社會受惠。

Thank you so much.

非常感謝大家。

(Applause)

（掌聲）