ARI: Hello, I'm Ari. [CLAUDINE: And I'm Claudine] Welcome to Proving the Negative.
ARI: We're a podcast all about exploring the different sides of cybersecurity,
from political to computer science, international relations to mathematics.
Join us as we talk to our friends about the work they do.
We have a treat for you, listeners! Today, we're talking about,
the supply and demand of surveillance technology across the world.
We're talking about spheres of influence, technospheres, and how it all comes together.
VALENTIN: Hey I'm Valentin Weber. I'm a fifth year PhD. student in cyber security,
and international relations at the Centre for Doctoral Training in Cyber Security,
as well as the Department of International Relations.
CLAUDINE: Could you give us an elevator pitch about the work that you've been doing?
VALENTIN: The proliferation of surveillance technology,
which we have seen taking off in the last couple of years.
It's about the increase of deployment of CCTV cameras with facial recognition.
It's about journalists being targeted by spyware. I really wanted to understand,
what's driving the demand, but also what's driving the supply.
Suppliers of surveillance technologies are China and Russia and Western countries,
such as Italy, UK, US who are also exporting that surveillance gear.
I was interested in the Chinese and Russian models of surveillance,
information control, censorship, self-censorship and comparing the two.
Also how 'norms' go from these two countries abroad.
Diffusion of technology, but also the norms that come ingrained in that gear.
I was interested in the countries buying that surveillance technology,
if they're relying on China or Russia, are being drawn into spheres of influence.
Are countries still maintaining access to technology afterwards.
Have we seen any evidence? What are the ways that they would do it?
What's their interest in maintaining access? In selling that technology?
CLAUDINE: What do you mean by "proliferation"?
By proliferation, I mean specific events in recent history where there was a coup d'etat,
let's say, in Egypt. After that, Egypt turned towards a major supplier (China),
they engaged in a contractual relationship importing [technology]
geared towards maintaining public security, (e.g., surveillance cameras)
or getting ideas from those countries.
One Egyptian parliamentarian said they want their own Facebook,
to better control the information environment at home.
So it's really about a bilateral relationship between two countries.
Technology transfer, but also a transfer of ideas and training.
Training for how to access citizens phones for law enforcement officials,
they would have specific gear for accessing your phone or computer.
CLAUDINE: Why has there been proliferation of surveillance tech and trade relationships?
Are there specific events that you could point to? VALENTIN: There were specific events.
Russia and China promoted it to certain regions. All countries have their specific interests,
whether that's trade, whether that's political interests, security interests.
China and Russia have identified their regions
Chine - the Belt and Road Initiative, which Egypt is part of.
The ancient Silk Roads,
the idea is to revive the Silk Road and declaring countries a strategic priority.
There has been a push coming from China to export to those regions.
For Russia, mostly post-Soviet countries,
where there is a quid pro quo - Russia is supplying military equipment,
also technology to surveil the Internet infrastructure that is then deployed,
in telecommunications companies that run the Internet domestically.
I've looked at countries where I would have expected them to have a demand
for that technology because they had a lot of protests,
they had a really unstable political environment.
Zimbabwe was interesting. I interviewed government officials asking why they bought the technology.
What was their interest? Why from China? Primary evidence of why contracts happen.
[It was] A fun part of the research, to get so close. I did this in Zimbabwe, in
Thailand, Zambia. I got primary sources to understand specific periods in time.
Government officials in charge at the time. ARI: When we say primary sources...
What is a primary source? VALENTIN: Specifically to my project,
I categorise those government official interviews as primary sources.
It was really difficult to get a hold of them, so I had to
reach out to my network and snowball - start from a colleague and go from there.
And then I would go from one country to where another diaspora is located.
Then it was really interesting to uncover those networks of people.
That was difficult because a lot of these people are very busy.
Another [primary source] was network measurements of Internet infrastructure.
We tried to discover surveillance middle-boxes, which are
deployed at various points in a country where lot of data flows through.
These are used to monitor content, filter spam and to slow down your data,
(if they've monitored your traffic and you've used too much).
It's used for censorship - we covered Huawei in different countries.
We found them in several, and
we found even more, thousands, across the world, deployed by the UK by
over 80 countries or so, deployed even more widely.
That's also a primary source - where we saw a geographic location.
Another [primary source] would be corporate documents,
websites of Russian companies where they would say "we sell to country x",
I would take that as a primary source. You could argue that it's less reliable.
That's how I measured and tracked the export of surveillance gear.
That's a primary source of their activities. CLAUDINE: The subversion of cyber security,
Could you just explain a little bit what that means?
VALENTIN: Surveillance is about the subversion of cyber security.
If you want to do large-scale surveillance, you have to weaken systems.
You have to weaken end-to-end encryption, you have to weaken,
communication that happens between a website and your computer.
I looked at Chinese government websites and found that they're really insecure.
A lot of them don't deploy HTTPS on login portals. Security practices are not up to standard.
Intentionally subverting cyber security in order to do surveillance,
that's what I mean by the subversion of cyber security.
There's discussion in the EU and US to weaken encryption for various purposes,
whether that is terrorism or (what law enforcement would consider) criminal behaviour,
that would be another way subverting cyber security. That' where my interest comes in,
It's a paradox where countries are intentionally moving into that direction
looking into the details of how you'd build a backdoor to maintain access.
You wouldn't design a back door and make it look like a back door.
You want it to look like a bug. You can subvert cyber security in a subtle way.
CLAUDINE: How do countries deal with using surveillance equipment, or
surveillance models that are imported from countries such as
China and Russia, which Western democracies might view as antagonistic?
VALENTIN: Some surveillance concepts were actually brought to China.
IBM was one of the major thinkers behind smart cities (digitising the city),
and that was really welcomed in China.
They adopted that concept and developed it further. China and Russia
have learned from Western concepts of law enforcement operations.
Outside Europe and America,
it was difficult to actually put those systems in place. Within China,
you have a government which has a strong capacity to buy the equipment,
they have a lot of data on citizens already, gathered throughout the years.
They have a really strong surveillance infrastructure in place.
A country like Zimbabwe would love to have such a system in place.
But for them, it's difficult to: get citizen fingerprints, install facial recognition,
to actually make it work and keep it operational.
If someone has an interest in keeping human rights alive,
that's a good sign. That those countries are not able to easily do [surveillance],
CLAUDINE: How did the officials you spoke to grapple
with that paradox between security and freedom?
VALENTIN: The government officials I spoke were in favour of freedom of expression,
upholding privacy of citizens. They managed to be part of the opposition.
For them, it was interesting to explain what was happening.
They were in favour of of not pursuing political dissidents/targeting groups.
They explained how governments decided to buy technology and go forward.
So I didn't talk to any hardcore autocrats.
The people I talked to were willing to share what was going on
under the condition of anonymity.
Traditionally, a sphere of influence would be defined by one country's influence
over another country, which would mean, at the same time,
the exclusion of other countries having influence in that country as well.
During the Cold War,
Eastern Europe being a sphere of influence of the Soviet Union
and the Americas being a sphere of influence of the US during the Cold War,
Countries would know - "okay,
we're not going to interfere within those spheres of influence".
Today in a technological sphere of influence,
It's really difficult to say you can exclude anyone from that sphere of influence.
If you're China and export technology to Egypt and subvert the technology,
it means that you have a privileged capability to access that technology.
It doesn't prevent other countries from access.
Influence on a country's governance (how they perceive technology),
if they can shape ideas... e.g., the US within the Freedom Online Coalition.
The US has a strong influence on how those countries perceive technology.
You have that vision of the Internet, and you shape the norms that control technology.
That's technological spheres of influence, 'technospheres' for short.
ARI: Take us through technospheres!
Technospheres is a term that I coined.
China supplies of a lot of technology to Zimbabwe, Egypt,
Thailand... that means that [China] can build back doors if they want to.
That means it has a privileged capability to control technology in these countries.
It has a strong influence on how those countries perceive and use technology.
[Egypt might say] "We love what China is doing in terms of surveillance and...
"... censorship", and they'll do it in a similar way.
And that's what a technosphere is.
We can see those technospheres now emerging within the world,
and those technospheres usually entail major hegemon, whether Russia,
China, the US, but also the EU, through their ability to shape privacy regulations.
In all these layers and ways in different countries, technospheres
emerging [means] smaller countries will be drawn into spheres of influence,
where they will be pushed by major countries to take sides.
A technosphere is a privileged capability
by a major hegemon to access or control technology within another country.
It's also the ability of that hegemon to influence the governance of technology.
ARI: I don't know what a hegemon is, and I'm really curious...?
VALENTIN: A hegemon is a very powerful country that has a lot of
influence over smaller countries (referred to as 'vassal' countries).
There is a strong hierarchical nature between two countries where a
hegemon can direct or influence what's happening in a less powerful country.
Examples are: US, China, Russia. Regional hegemon: Iran, Saudi Arabia.
CLAUDINE: So what's next for you?
VALENTIN: I was always drawn towards think tanks, they provide a mixture
between being able to do research and also organising
events and being plugged into the policy world. I'll be joining one in Berlin.
I'm very much looking forward to it. That's next for me.
CLAUDINE: Where can people find you on the interwebs?
VALENTIN: I have a website...
https://valentinweber.com - I'm also on Twitter @weberv_
Also on LinkedIn. CLAUDINE: The last question, which we ask all of our guests:
What is cyber security to you, Valentin?
VALENTIN: Probably 80% of my day. You know, it's work,
it's my friends, it's many things and
it's been part of the last five years of my life, starting with the PhD at the CDT.
Cyber security has so many categories that you can't be an expert in even two
App[lication] security or supply chain security, hardware security.
We continuously understand what it isn't. We're all plugged into cyberspace,
everything's connected, the term is evolving every day.
I can't give you a really good definition - the absence of surveillance, perhaps.
CLAUDINE: That was our interview with Valentin.
Join us next week for another fascinating conversation.
In the meantime, you can tweet at us @HelloPTNPod
And you can subscribe on Apple Podcasts or wherever you listen to podcasts.
The title there is PTNPod. See you next week. ARI: Bye!
CLAUDINE: This has been a podcast from the Centre for Doctoral Training in Cybersecurity, University of Oxford.
Funded by the Engineering and Physical Sciences Research Council.