The Third Servile War was over. The slave army has been defeated, and the survivors are offered a pardon by their Roman captors. The only requirement was that they identify Spartacus, their leader (Kirk Douglas). Rather than give away his identity, however, they all begin to yell out “I’m Spartacus!”—thus preserving his anonymity by overwhelming the Romans with possibilities. (Spoiler alert: they all die as a result.) What lesson can we learn from them about preserving privacy through obscurity? The right to be forgotten has been held as fundamental human right by various governments. The recent Facebook scandal and a series of large scale breaches has centered the discussion on the privacy implications of this right. Most people agree that the right to be forgotten should allow users to remove accounts and material that they have created in the past — but how easy is it to disappear from online social media and networks in an effort to preserve one’s privacy? To find out, I created a fake identity and gave it accounts across 24+ sites, including the “usual suspects” (gmail, twitter, facebook) and some not so “usual” (Ashley Madison and MySpace). The privacy agreements and the experience with these sites demonstrated how difficult deletion is for end users. Governments have not mandated these privacy protections for users systematically—and even if they had, enforcement would be problematic; there is little incentive for businesses to prune existing user data. Since users cannot rely on governments to ensure privacy, a different method of privacy assurance is proposed: privacy through obfuscation. Existing accounts and personal data may be protected through obfuscation techniques, common in other research such as location cloaking. An open-source proof-of-concept (“Spartacus as a Service”) is presented that allows for these techniques to be employed on several well-known online applications. This prototype seeks to ensure that privacy is maintained without relying on organizations removing all data from their systems—effectively yelling “I’m Spartacus!” on behalf of the user. BIO Mike Kiser is insecure. He has been this way since birth, despite playing a number of roles over the past 20 years—from the Office of the CTO to Security Strategist to Security Analyst to Security Architect—that might imply otherwise. In spite of this, he has designed, directed, and advised on large-scale security deployments for a global clientele. He is currently in a long-term relationship with fine haberdashery, is a chronic chronoptimist (look it up), and delights in needlessly convoluted verbiage. He has been a speaker on topics ranging from identity governance to security analytics, network security, and various related privacy issues, and is the co-host of a podcast illuminating all things identity. In a past life, he developed mathematical models to simulate collisions between galaxies.
 Alright, welcome back. Let's get started with our next talk. Please welcome Mike Kaiser giving a talk entitled I am Spartacus and you can be too Spartacus as a service Thank you very much Unnecessary applause, but thank you anyway I'm like Kaiser who I am is unimportant. You can find me online. I'm not gonna have a biological slide or anything like that instead We're gonna start With a refresher on an old story who here has seen the 1960s movie Spartacus That's quite a few we'll say we'll review just the basic story here just a level set and it begins with Where every great story does with Kirk Douglas sweaty hot Clef chinned He was a gladiator The real Spartacus was not Kirk Douglas the real Spartacus lived in about 70 BC and by lived I mean that's when he rebelled. He was a gladiator. He led a rebellion took 70 or so of his fellow fellow gladiators with him and Formed an army They gathered more and more men more and more soldiers and what happens when you gather an army. Oh by the way This is what a gladiator looks like This is a rebellion of gladiators. I'm not quite sure what the physics are in play here, but that's okay. What happens? When you rebel against Rome well Rome comes after you Rome came after the real Spartacus three times And the first two times for sure the third time's a lot unclear Spartacus and his army smoke them They defeated them soundly now But what happens if you rebel against someplace like Rome? Well, eventually you lose right because Rome is Rome and you're just kind of small potatoes And at this point I'm switching to again the movie that many of you have seen which I consider the canonical forum of this story So they capture his whole army to capture Spartacus They want Spartacus. They want to know who he is, but they don't know who he is And so they sit the entire army of rebels down and they say tomorrow you are all going to die Unless one of you tells us who Spartacus is as Lawrence Olivier being brutal right and then Spartacus, Kurt Geis is sitting there Looks around looks around is about to stand up and then one by one We all know his men jump up and yell I am Spartacus. I am Spartacus Much like it would look like if we did in this room today. Don't do it right now Upshot is they couldn't tell who Spartacus was right because his privacy was obscured There were too many Spartacus is available to choose from and he acquired in that moment What he wanted he wanted his past to be forgotten. He wanted to be unknown. He wanted privacy Spoiler alert They all died the next day But in that moment it was a glorious glorious 30 seconds to a minute especially on film So what I wanted to do after seeing this film a couple times recently a couple years ago is it Gave me an idea. I was I was thinking about the right to be forgotten and privacy and I wanted to know how bad things really Were and since I've been on the internet since like 93 or 94. I Was a tampered case what I wanted was something to kind of level set White space Greenfield whatever you want to call it. So I did what anyone would do in my situation I went to Target And I bought a phone with a credit card on film Terrible operational security, but now I had a phone for a fake identity. I wanted to create this is my my friend There's probably enough information that you could go and hunt her down or one of her replicants You know, she was old enough. She lives in Austin where I live. She loves running. She loves reading She's a graphics designer and really involved in that community in Austin Or so people think and her relationship status is It's complicated Which opens her up to a lot of unusual discussions. So like I said, I created my friend Which is a little bit more complicated than I thought for reasons. I'll go into in a bit signed her up for various online applications social media apps primarily 24 25 of them some of these you'd expect some maybe not right? I I started with the basics or the trifecta Facebook Google and Twitter and then added more The because I had a prepaid phone it was a little bit difficult because Twitter Realized as a prepaid phone, but that was okay I set up for a Google account and that gave me an email address to sign up for the Twitter account I was learning how to do this step by step. You'll also notice other things on here Like my space because who doesn't love a good MIDI song And I signed her also up for several dating apps in the area Bumble and I also signed her up Which I questioned my choices at the time for Ashley Madison Now the big risk here was that I had put her in my own area code Which means there was a chance I would see someone I knew trolling for someone I didn't know That didn't happen. Thank goodness. I did not see anyone I knew But spoiler alert and probably more than at least half of you in this room would already know this Don't be a woman on the internet There are many many things I can't unsee She got unsolicited pictures. She got hit on on every network including linked in which Anyway, staggers my imagination. I think it's a great social experiment to understand what reality is like what I did then was I went about trying to erase her and See how long she stood around because you know She's got some normal data and blue that wouldn't she wouldn't care if it was out there But there's always that sensitive data right those controversial statements or those photos or whatever else and so as I had signed her up And started deleting her. I finally went through and I read through all 24 25 Different privacy agreement and terms line by line It's not very exciting Sometimes you find Things you expect but not but more horrific than you expect for instance This is in the Pinterest terms of service, which is one of the most unusual ones I found these are almost back-to-back statements it says you retain all rights to everything you post Two sentences later, but by posting you give us What 20 like 15 different verbs to do with that data? so it's kind of a dumpster fire in summary of all of those Things you'd expect here right five of these 24 25 Track you on third-party sites even if you're not logged into them right Facebook or other people will know through Tracks and pickle pixels and the like that you're looking for Ruda bagas or something of that nature 14 of them just tell you straight up. We're gonna sell your data We're gonna sell what you do what you'd like some of your attributes and the often times they will couch it in Customized advertising language. That's kind of basically what they what they mean and then eight of them Basically said we're gonna keep your data and we're not gonna put ourselves under any obligation Ever to lose or get rid of your data and this is beyond some of times what you'll see which is a We have to keep your data for a certain period for financial regulations. This was just we're gonna make no promises We might hold on to it forever So exciting now those of us in this room. We're not really surprised by that, right? We kind of know the game plan kind of know what the current situation is when I talk to friends when I talk to family Sometimes it's harder to explain what they're agreeing to for signing up for those services Or how long they will last and how they can't be forgotten on the internet There's a tool out there Called terms of service didn't read. I'll show it to you live in a minute but this is a browser-based plugin That you can install that every site you go to it gives people a letter grade in their browser telling you This is a great site. This is a bad site and if you click on it It'll break it down obviously. It's color-coded It'll break it down as to what they've agreed to by using or signing up for that site I highly recommend you know using this but also highly recommend giving this to your friends and associates to Alarm them and make them more aware of what they've agreed to so Terms of service were pretty bad that my friend agreed to her data may be around for a long time Even if they delete it. It's already sold to advertisers, right? But what about data privacy loss you might be saying Mike that'll fix everything Right well, my name is Mike. By the way, that's what you would say that You know United Nations considers Privacy a human right and there are different expressions of that most famous one is the GDPR You've seen the Equifax stuff you've seen the Marriott stuff fines are starting to come in So there's a little bit more attention being paid to that But it's it's a good start, but it's not going to do a whole heck of a lot anywhere You know in the near future and if you look at the larger picture if you look at Regulation worldwide It's sketchy right There are a hundred and twenty or so countries with national With national privacy laws either enacted or in progress You have of course the GDPR you have which does fines you have PDPA and down the Philippines Which does jail time for people and then there are the lighter colored countries Including the United States of course, which has no national Privacy law we have things cooking like CCPA and New York and there are at least six or seven senators that are trying to introduce Legislation but again, even if they do you just do like a tax haven and go to the lowest common denominator Where you don't have to protect privacy? Which brings us To Pshin see I'll call it so we can't rely on enterprises to protect our privacy or to not sell our data And we can't rely on governments necessarily to enforce things So we need a third option An option that will basically give my friend and us and others like us the possibility of having privacy and to do that We're gonna go back to sweaty man We're gonna take our inspiration from the story of Spartacus and try and take matters into our own hands However, horrific that might turn out privacy via obfuscation And so what I did after I had gone through all of this Is I started writing an open-source tool? I called it Spartacus as a service a friend recommended that because the acronym wasn't taken and So what I did was I used node Because I vaguely knew JavaScript and I was looking for just the easiest route on because all I really wanted to do here in The beginning was get a proof of concept make something see if I could alter advertising to see what was possible So it's written in node that has the convenience of having the passport module which does all the OAuth for a Lot of the services for you So I wouldn't have to muck about doing token work per se And then I'll talk about that last one in just a minute I pushed the latest version to GitHub yesterday I think so every almost everything you're going to see in a demo today is there online and you can download it The tool takes three tactics and they are tactics stolen from location From obscuring your location if you're trying to hide that there's a whole book you can read it about it Called obfuscation. I think from Harvard Press And there are three ways to do this if you think about location enlarging the radius shifting the center and Filling your channel with noise Now these first two Have to do more with creating Multiple use or multiple whatever the target identity is and the third is a slightly different jam So let's talk about those first two first first enlarging the radius This is where you take the identity and you take one key attribute whether it's name or location or a couple of them and you replicate them across 20 30 Scale up as many as you want to identities that look a lot like you Sound a lot like you, but they're not quite you the idea here is the same thing as in top gun Which is now a reference I can use again because Tom is making another movie You remember he's flying along. He's being attacked actually every airplane movie ever and what they do they throw out chaff right to confuse the Missile coming that's the same concept here. You're not making it impossible to find you, but you're making it more difficult Second way is very similar except this time instead of a test text based attribute We're doing it with images with faces this exists because of reverse Google image search. I mean maybe it's just me, but who hasn't looked themselves up to see how popular they are or where they're They're listed where they're what in action is about them. You might want to do that when you go home The way to do both of these is actually pretty straightforward The faker library is out there and that can generate a huge amount of data and save yourself a lot of time people use this a Lot for unit testing in software development sometimes for fuzzing It can generate from a database Like I said quite a bit the tool at this point uses what's shown on the screen Basic information using password email a URL link to an image This library can also give Account data fake transactions a brief bio background It's pretty wide sweeping now note that things like it says older than 21 on the date of birth a lot of times It will return a date of birth, but it's not going to put any restrictions other than it being in the past So if you want to use this and have Correlation between birth dates and death dates or anything else you're going to have to put filters on that So for example, I put a check to make sure that data birth was older than 21 because that's just gross So to take a look at that real quick, I'll show you here in the tool So this is what it looks like again, this is just node running in an express instance which makes it really easy and pretty to demonstrate in public and Then you can either OAuth in which I'll show you in just a minute Or you can come down here to create identity set and what this is going to do is it's going to present you with Basically exactly what you would think you choose how many identities and then you put in What you want common to those identities if you don't put anything in these fields Then you get basically a JSON Dump of all of the data you can see different names different addresses different phone numbers obviously There's no real phone number email address behind these But just FYI if I put in something That I want common to all of them Say a first and last name or if I wanted everyone to look like Justin Timberlake I could do that and Now all my data Matches up. That's probably really hard to see in the back I'll have the same first and last name the idea here is it's facilitating those use cases and what I can do now or I've done in the past is I've taken that information And Now I want to process that in bulk now This isn't quite finished. I tried this a couple times with Amazon's mechanical Turk Which is great, but remember we're dealing with some kind of Verification In other words, there's gonna be some kind of email or some kind of phone based verification Remember I said earlier that Twitter caught the phone number Email is relatively easy. You could spin up your own domain There are lots of email addresses that can be temporary and can be used and you can forward those to whoever's doing the work for you on something like Turk But phones are more difficult. They're catching prepaid phones They're catching obviously Google voice if your number has been cycled too many times or too quickly It won't work either from day to day Google voice has worked or hasn't worked And I really I'm looking for a way to make this programmatic obviously temporary numbers I'd rather not buy a thousand sims or anything like that. So if you have ideas I'm all ears Because I would really help this part of the project Side note when I was doing this When I first made my friend's profile and her backstory which I had a whole backstory for This was a picture I used This is not my friend Obviously not the picture that I'm using today either And I blurred her before because I'd like her to not be swamped and live a little bit longer in her fake existence I use this picture and I was having a great time and posting content and meeting graphic designers in Austin who thought I was a 30 year old woman and then my friend called me up and he said hey Mike You don't want to use this picture. I was like what what's wrong with using this picture? He said well She's not a white space. She's not Greenfield. It's like what do you mean? He said well? Have you done a Google? reverse image search on her I said no Is she on you know a couple sites like 10 20? He's like no just go do it. So I did 25 billion sites use her photo and As is obvious now, why is that because everyone's doing the same thing I was doing if you're writing a bot Where do you go look for an image open source? Stock photography because you don't feel like there's any licensing or any issues there, right? Almost every actually everyone I haven't found one that's not like this that isn't just all over the place this The picture of this woman has been used to represent policymakers in Washington DC sex workers in Nevada There is a mystery Novel writer selling books on Amazon that uses this photo on her website to represent herself So The big takeaway if you take away one thing from this talk It's that you don't really need a tool To obscure yourself to give yourself privacy of your image. Just be sure you're in lots of stock photography looking really happy and Then every dream you have will be realized you'll be an author. You'll be a playwright You'll be some other things too, but And choose wisely, but that's that's one route you could choose to go So upshot is lesson learned I changed the photo So that is the the first two right and large in radius and shifting the center Let's talk about something I find kind of more interesting to be honest Which is the process I call filling the channel with noise. This is not creating new identities This is just deluding the information that's out there about you on your existing identities so that people looking for you or People doing surveillance or whatever else has left and less of an opportunity to know what's real and what's not very similar To the talk on tutorial fashion. We just heard So basically it's taking something like this. My friend originally was an avid reader and And she ran every other day by the way if you're faking an identity choose repetitive hobbies Dead simple to tweet about I ran five miles. I'm exhausted. I read this book really really easy She's also searching for mattresses and looking to buy a Volvo which seems like an odd combination except that those are orthogonal and So I didn't think one would necessarily be related to the other and that way I knew if I got Advertising which I started to measure if I got advertising for a Volvo Then I had a good sense that it was because She'd been searching for her tweeting about it and we've all had this feeling right You know you're talking to a lot if you have one of those or your friend and you have a discussion All sudden advertising is is popping up. Well the idea of this use case is to flood the channel like I said with other things in this case I was using Barbecue and politics and violins by hand basically to throw off advertising To make sure they didn't quite know who she was what she was into and thus give her some kind of privacy Now as you might imagine Doing this across 24 apps is a pain right because you'd have to go to Every one of these and to do this programmatically create an app on those and get an API key and all of that So I started with three and that's where the tool is today The first one I started with was Facebook and That was great It was pretty easy and Facebook is kind of like the Wild West or it was you could a you could you Programmatically put things on anyone's wall and it looked like it came from them once they had given you Oauth approval to do So with your app Good for Facebook. They realized that was probably a bad idea. So in 2018 they shut that part of the API down For four months. I still had hope because they left the life events API open So while I couldn't put content for them, I could have my Target or my friend get married get divorced moved to Arizona Have three children live in a bus down by the river and then they shut that down too So Facebook is kind of a hard nut to crack at this point. You can you can put pages or links to pages on their Facebook wall as if it came from them, but it is all based It's an iFrame from from from Facebook and you can't pre-fill the text So it's a little more complicated. I'm looking at ways to do an end around like with Instagram or something else because all I Really want to do is influence that same marketing pocket Google is pretty easy Pretty table stakes Basically once you get them all off then the tool I'll show you here in a little bit But it can go out and just do a search at a rate that doesn't get rate limited and counts as independent searches for Google Because basically what you're trying to do, of course is altar Alter basically this page This is an account I made earlier this week And already it's decided basically almost out of the box that this is what he's into Almost middle-aged male, of course, he likes football for some reason anyway The idea is here. You're shifting this This perception of the target With those Google searches and the like now in the future I was given the pretty great idea This week that what you could also do is since Google historically although they say they're not doing as much anymore historically has searched through your email and indexed it to get flight appointments or Doctors appointments or purchases and receipts you could set up a Service where we could send an email to a Google account have a filter on the receiving Google account You'd never see it, but it'd be automatically altering what they thought you were interested in what you were doing And then Twitter Twitter was the most exciting to me Because that was going to be more creative than some of the others. I wanted a content generator That I could use to generate tweets and I wanted it to be Realistic enough to alter advertising and to be fun But I also wanted it to be mutable and not mutable but mutable in other words You could turn it off or filter it out To do this. I originally used a mark-off chain generator You can Google all these terms here in a minute. I'm gonna try and explain what I use but it's you know Time constraints and all of that these these are great because it uses word frequency and goes kind of state-to-state and a state graph and occasionally It can produce really great stuff like this tweet from June It says indeed Jane you ought to believe me No one who has ever seen you together can doubt his affection or his admiration for the basting of pork ribs Could she have seen half as much love in mr. Darcy for herself? She would have been concerned with data privacy So this is a mash-up with mark-off chains. The other thing you can do is you can combine sources So this is a combination of Jane Austen the how to barbecue from Aaron Franklin may he live forever from Austin, Texas and the actual text of the GDPR regulation so Not quite the best-selling fiction. I'm gonna be able to go sell That's a different village probably But the problem with this this is one tweet out of like ten thousand that worked this well Which is why I took a screenshot of it obviously a Lot of times what it sounded like was just too awkward to Not great and so I shifted to a recurrent neural network to do this And the part that is because mark-off chains don't remember the full history They just remember like it's someone with a really short term memory like someone with a severe head trauma So in the short range it does great. So for example this sentence I grew up in France speaking French right pretty simple. There's not much gap between the the history of the prompt and what you want the mark-off chain to fill in now It has much more of a problem with something like this Where there's more space where it's I grew up in France then I moved to Germany spent several years studying Basque pottery under a master And then wrote a best-selling book when I was young I spoke now other than being pretentious This is a just a long sentence with more information and so by the time you get to where you need to fill in the word the mark-off chain Just basically looks Really close to where it needs to fill it in and so sometimes can Do something totally weird at least that's in the ballpark. It knows it's a language But it doesn't quite know what you're looking for so it takes a pot shot now a Recurrent neural network will remember everything In fact, it's being a house design. It will remember everything in your text And so it can say oh well this is a continuation of what came before so obviously he's into French So it bought me. I felt like more coherence caveat at this point All of this is just my experience my past training with mark-off chain generators and artificial intelligence intelligence is like zero so May have just been doing the execution of this wrong But it also gives hope to everyone in this room to be able to do the same thing because I'm just using kind of off-the-shelf stuff to do this so The neural network like I said, it's time series based machine learning has a long-term memory You can train you can rent GPU time and train it and then you can have a model that you can use wherever you want To be able to generate this kind of content whether it's JavaScript or node or whatever else currently available in the tool Is this cast of characters some of this came with the the open-source? Neural net base some of them I self-generated so you have things you Like Hemingway and Darwin You have the boy you have her mind his mom Obviously you have Aaron Franklin, which is very specific to me. That's the barbecue guy at Austin, Texas let me know if you need a brisket later on and things like No, every state of the Union from the beginning of the United States until about the Obama years Because no one needs that extra Extra words much better like that To train a model I used something called Paper space again because it was easy. This is a GPU rental facility. There are many like it I have all the the instructions here You can have them later to go and do this yourself basically you you download the package and then you go and you find your text now Your text you can go to Gutenberg. I did it earlier Where I downloaded today actually I downloaded the Sherlock Holmes complete works Really it's any text you want it needs to be if it's just utf8 text It needs to be about 500k or bigger for it to start to be viable the cool thing about This type of neural network is that it learns syntax and format as well. So if you fed it The source code for a library it could start giving you source code back It wouldn't necessarily run and who knows what it would do, but it would look pretty cool So after you run the job It goes out there and does it gives you feedback as it goes and it trains it up and Then what you do after that is you wait and Depending on how many how long you want to train it It takes a little while it I started one earlier today. I'll show you in just a minute Like I said, it was Sherlock Holmes. It took 35 minutes and cost me a dollar or 50 cents So very easy to do very viable Like I said anything any text you have it would work Yeah, you go out and you download the model you put it in a particular file In the Spartacus tool and it'll automatically pick it up from a drop-down list and add it to your sources So like I said what I wanted to do is I wanted to flood the channel with noise And started in this state and then started altering it in part with the tool and some by hand And let me show you what the tool actually looks like here So we've seen this before except this time We're actually gonna owe off in with an identity I created a couple days ago You see Twitter he's already logged into Twitter so he kicked back And so now he's actually logged into all three and it linked them in a in a common session because I've been using it all day Facebook obviously doesn't do anything at the moment, but Google and Twitter do Like I said what Google is going to do for now Is you can choose from one of the models that are in the system that come with it automatically when you when you clone the repo and Then you can choose whatever it is for example barbecue and choose how many repetitions you want it to search for it to alter your Search history and then it goes out and does it this is a lot like Selenium As a base, but it's still in the package and so you can go out and do whatever you want It will start altering What your search history is and how Google thinks of you in the background so simple case for for Google now Twitter This is a little bit more interesting because it's using the recurrent neural network. I was talking about so what you do is you choose What model you want to use and then you give it? Sorry starting to try then you give it a Prompt in the words you give it a seed text because it needs something to start somebody give me a five or six word half sentence That was the fastest response I've ever gotten thank you And then once you hit the reset It takes a shot at it So what's my horse I useful seed there's sometimes it works really well this is a lot better than Markov chain was Sometimes it sounds like someone fell on the bathtub hit their head and started tweeting about it but and Harry Potter can be a little creepy because Actually if you do it too quick it does that because the history blows up There we go because you know it's It's talking about children If you do someone like Hemingway you tend to get Wow that was really odd You tend to get shorter sentences. There's more violence and more alcoholism in general Shakespeare is interesting because it's a play and remember it does formatting So a lot of times You get lines and sometimes you even get stage direction, you know exit stage left eaten by a bear or something like that Which you may or may not want to tweet about if you do state of the union it gets the opposite it gets really long and I mean picture yourself sitting in Congress. That's that's the experience you get right it's Clause after clause regardless You'll also note that there is a prefix tag here, right? What that is is that? Mutability I was talking about before where you know you don't necessarily want to flood Your Twitter account or your social media accounts with Harry Potter fanfiction. That's just kind of weird So when you hit the obfuscate button, what will happen is it will go out and tweet on your behalf And we can see it You can see it microscopically So you can see that it It's been tweeting on my behalf off and on all day But there's a prefix and so what that means is you can tell people you care about and that you don't want to infuriate You can say look set up a mute Function for this string so that you know this didn't come for me and I'm not crazy insane Which is helpful Remember this is also These are also all No based still I have not it gives the opportunity to transform these into web services But I haven't done that yet That's kind of one my next steps to make it more programmatic so you could script it now while this is for Twitter This has a wide range of applications for some of the other social media apps anything that that relies on Text-based content creation that sort of thing Could use this and so with that passport module on node you can actually Set up the authentication once you get the API key you can set the authentication rapidly and then you can add on those modules app by app and very quickly build on What's already going on? So over time I did that with my friend and in her ongoing saga here and She started to look more like this she was really into brisket and pork ribs for a while and Just sounded like a crazy person talking about national problems because she was sometimes liberal sometimes conservative and sometimes just Really bad politically informed and then I I manually added on violins just to give a little more color to it Over time and this is really hard to see in the end What I have here is I wanted some kind of Sciencey feel to this so as I was doing it. I was measuring manually at this point Well, how advertising was changing over time so before Spartacus we have BS and AS Before Spartacus and after Spartacus Beforehand she was really getting a lot of Stearns and Foster Tempur-pedic those kinds of things and she was really into the C90 Volvo or something over time That actually dropped and so mattresses dropped from like 50% of the advertising down to about 15 now keep in mind this was me doing it every day for like three or four weeks, but Upshot is it actually changed How? advertisers Viewed her who they thought she was what they knew about her was now different She had other things obviously the things that was actually pumping content out and searching for Started to influence it in about 18 hours after I started She started getting advertisements for full on Displace smoking units for barbecue which she didn't buy but it was helpful So this should be your next question You should be thinking Mike this is this is fun But is this practical does this have any value? Twitch our play yes and no right both end you don't necessarily want to flood your Social media life with crap you might you know, that's your own issue at the same time this kind of concept Replicating yourself to hide who you really are and your identity Creating enough content that no one can tell what your true content is or even filling fake accounts with fake content has Applications think of of people who are being stopped or people who are being sought after Someone who's searching an ex or an ex partner searching for someone across state lines trying to find out where they are now What their life is like now to be involved in? That is a great question the question was does the Twitter API allow you to do geolocation I haven't looked that's one of my next things to do is to actually Spoof location now keep in mind. It's running locally And it's just doing an OAuth so that I think a VPN would come into play because as far as Twitter knows you're tweeting in from Whatever that is so buying programmatically we better and more efficient That's good point In addition to personal issues You know in 2017 the United States government announced they were going to start requiring Social media accounts and people applying for visas or coming Into the country and in June they announced that any social media accounts you've used for the past five years You would need to turn in to the government so they could review it and look at it So there's a potential application there like a set of fake accounts or fake content as a way of end-rounding violations of privacy in that way more recently still In June of this year there was a Journalist who came into Austin, Texas my hometown which personally applicable to me. It's very Lovely to come into costumes in Austin usually I hardly stop walking It's like ten minutes, and I'm out if I have a carry on this guy came in got stopped You can read the story in the intercept was held for Five hours they went through all the stuff all the social media accounts So it's it's this kind of thing and even five days ago the EFF Released a latest report on what this means and what the implications are for people looking near social media Whether they're doing it for a job or more particularly in this case in immigration And even if there's not a special situation where someone's in danger or it's a refugee seeking asylum Who's afraid to give their accounts because they already fear violence back home It's not a foreign concept for anybody, right? This is a quote First scene in Banksy graffiti first attributed riff off of anybody remember Andy Warhol everyone will be famous for 15 minutes What's the kicker on both of those stories? Neither one actually did either of them Warhol didn't say it and Banksy didn't draw it But it makes a cool story, which is the same kind of vibe here, right? What what I like about doing this tool and what I like about telling the story of Spartacus and in fact using stickers to do it is That people get it right people that are not in this room people that are normal that aren't concerned with security They don't say oh, I have no idea what you're talking about. They say oh, I I want that how can I buy that? How can I know more about that and so that's the power of a story like Spartacus? Is that it gives us a chance to advocate for them for people who are in trouble but also? to be like Kirk Douglas or his friends rather and Help have those discussions so that people around us know more and are empowered to protect their own privacy through obfuscation Thank you All right If you have any questions for Q&A, I am walking on up to the podium Please make a orderly line or a disorderly line in light of the slave revolt theme here Nobody else has when I have a question okay is your tool available in the Russian language The faker tool actually flips whatever language you want you can set a locale so yes It's already internationalized for your use and accept now the tool itself is not translated to Russian but Question oh Given that the like Twitter and Facebook are cracking down on oh this way Oh given that apps like Twitter and Facebook are cracking down on fake accounts. Does that ever is that is there a potential like? If you start putting garbage on there, they tag you as I think that because the way the Twitter The way it tweets out It marks where it came from. I'll show you How so That's true if they thought you're fake and they deleted you but he's I mean in my mind the question too is they could block the tool or they could block any kind of faking mechanism To do it as well and it's identified, you know as whatever this is but most people don't look at that in terms of purposes But yes, that's one of the things my concerns was using it too much or too quickly I mean, I think it's a good idea to use it as a tool to help you out That's one of the things my concerns was using it too much or too quickly of being flagged as a misuse of the API or or whatever else And thanks Could it be extended to be used? With automations tools like Selenium something like that. Yeah Well, the the the first part definitely where it's polluting search history and doing that sort of thing. I think that the You could do the tweeting part of that as well in other words the mechanical putting it on Social media or the account but the creation of that content would still need to come from some source And so that's either pulling, you know pulling text or pulling content from a database or a repo or dynamically generating it like I'm doing So yeah, the Selenium thing has come up a lot this week too for sure If you preload a database of images Like that would require some manual work to collect them and to make sure that you're not getting absolute garbage or something extremely offensive But could you then port it to something like Instagram and just have it upload the image with a text document and yeah Yeah, I've thought about I've thought about that already and the the faker library actually goes out and you can tell it a set of eight or ten different Topics that it would pull from and give you images loaded but that's coming from a database But you could do the same thing like others also embedded in the tool Is a script to go out and download a hundred faces from this face did not this person does not exist Because that didn't come into being until after I'd already started the project But that would be helpful too because you need something that's usable imagery with those accounts and those identities And the other questions Have you been working how long we've been working on this to develop it not that like a Year maybe year and a half playing with things But probably a year of doing things but it's been I have a day job So this is and three small children as I dox myself But so it's you know, it's been a while but Questions All right one more big round of applause for Mike
 Alright, welcome back. Let's get started with our next talk. Please welcome Mike Kaiser giving a talk entitled  I am Spartacus and you can be too Spartacus as a service  Thank you very much  Unnecessary applause, but thank you anyway  I'm like Kaiser who I am is unimportant. You can find me online. I'm not gonna have a biological slide or anything like that  instead  We're gonna start  With a refresher on an old story who here has seen the 1960s movie Spartacus  That's quite a few we'll say we'll review just the basic story here just a level set  and it begins with  Where every great story does with Kirk Douglas sweaty hot  Clef chinned  He was a gladiator  The real Spartacus was not Kirk Douglas the real Spartacus lived in about 70 BC and by lived  I mean that's when he rebelled. He was a gladiator. He led a rebellion  took 70 or so of his fellow fellow gladiators with him and  Formed an army  They gathered more and more men more and more soldiers and what happens when you gather an army. Oh  by the way  This is what a gladiator looks like  This is a rebellion of gladiators. I'm not quite sure what the physics are in play here, but that's okay. What happens?  When you rebel against Rome well Rome comes after you Rome came after the real Spartacus three times  And the first two times for sure the third time's a lot unclear  Spartacus and his army  smoke them  They defeated them soundly  now  But what happens if you rebel against someplace like Rome?  Well, eventually you lose right because Rome is Rome and you're just kind of small potatoes  And at this point  I'm switching to again the movie that many of you have seen which I consider the canonical forum of this story  So they capture his whole army to capture Spartacus  They want Spartacus. They want to know who he is, but they don't know who he is  And so they sit the entire army of rebels down and they say tomorrow you are all  going to die  Unless one of you tells us who Spartacus is  as Lawrence Olivier being brutal right and then  Spartacus, Kurt Geis is sitting there  Looks around looks around is about to stand up and then one by one  We all know his men jump up and yell I am Spartacus. I am Spartacus  Much like it would look like if we did in this room today. Don't do it right now  Upshot is they couldn't tell who Spartacus was right because his privacy was obscured  There were too many Spartacus is available to choose from and he acquired in that moment  What he wanted he wanted his past to be forgotten. He wanted to be unknown. He wanted privacy  Spoiler alert  They all died the next day  But in that moment it was a glorious glorious 30 seconds to a minute especially on film  So what I wanted to do  after seeing this film a couple times recently a couple years ago is it  Gave me an idea. I was I was thinking about the right to be forgotten and privacy and I wanted to know how bad things really  Were and since I've been on the internet since like 93 or 94. I  Was a tampered case what I wanted was something to kind of level set  White space Greenfield whatever you want to call it. So I did what anyone would do in my situation  I went to Target  And I bought a phone with a credit card on film  Terrible operational security, but now I had a phone for a fake identity. I wanted to create this is my my friend  There's probably enough information that you could go and hunt her down or one of her replicants  You know, she was old enough. She lives in Austin where I live. She loves running. She loves reading  She's a graphics designer and really involved in that community in Austin  Or so people think and her relationship status is  It's complicated  Which opens her up to a lot of unusual discussions. So like I said, I created my friend  Which is a little bit more complicated than I thought for reasons. I'll go into in a bit  signed her up for various online  applications  social media apps primarily  24 25 of them some of these you'd expect some maybe not right? I I started with the basics or the  trifecta Facebook Google and Twitter and then added more  The because I had a prepaid phone it was a little bit difficult because Twitter  Realized as a prepaid phone, but that was okay  I set up for a Google account and that gave me an email address to sign up for the Twitter account  I was learning how to do this step by step. You'll also notice other things on here  Like my space because who doesn't love a good MIDI song  And I signed her also up for several dating apps in the area  Bumble and I also signed her up  Which I questioned my choices at the time for Ashley Madison  Now the big risk here was that I had put her in my own area code  Which means there was a chance I would see someone I knew  trolling for someone I didn't know  That didn't happen. Thank goodness. I did not see anyone I knew  But spoiler alert and probably more than at least half of you in this room would already know this  Don't be a woman on the internet  There are many many things I can't unsee  She got unsolicited pictures. She got hit on on every network  including linked in which  Anyway, staggers my imagination. I think it's a great social experiment to understand what reality is like  what I did then was I went about trying to  erase her and  See how long she stood around because you know  She's got some normal data and blue that wouldn't she wouldn't care if it was out there  But there's always that sensitive data right those controversial statements or those photos or whatever else and so as I had signed her up  And started deleting her. I finally went through and I read through all  24  25  Different privacy agreement and terms line by line  It's not very exciting  Sometimes you find  Things you expect but not but more horrific than you expect for instance  This is in the Pinterest terms of service, which is one of the most unusual ones  I found these are almost back-to-back  statements it says you retain all rights to everything you post  Two sentences later, but by posting you give us  What 20 like 15 different verbs to do with that data?  so it's kind of a dumpster fire in  summary of all of those  Things you'd expect here right five of these 24 25  Track you on third-party sites even if you're not logged into them right Facebook or other people will know through  Tracks and pickle pixels and the like that you're looking for  Ruda bagas or something of that nature  14 of them just tell you straight up. We're gonna sell your data  We're gonna sell what you do what you'd like some of your attributes and the often times they will couch it in  Customized advertising language. That's kind of basically what they what they mean and then  eight of them  Basically said we're gonna keep your data and we're not gonna put ourselves under any obligation  Ever to lose or get rid of your data and this is beyond some of times what you'll see which is a  We have to keep your data for a certain period for financial regulations. This was just we're gonna make no promises  We might hold on to it forever  So exciting now those of us in this room. We're not really surprised by that, right?  We kind of know the game plan kind of know what the current situation is when I talk to friends when I talk to family  Sometimes it's harder to explain what they're agreeing to for signing up for those services  Or how long they will last and how they can't be forgotten on the internet  There's a tool out there  Called terms of service didn't read. I'll show it to you live in a minute  but this is a  browser-based plugin  That you can install that every site you go to it gives people a letter grade in their browser telling you  This is a great site. This is a bad site and if you click on it  It'll break it down obviously. It's color-coded  It'll break it down as to what they've agreed to by using or signing up for that site  I highly recommend you know using this but also highly recommend giving this to your friends and associates to  Alarm them and make them more aware of what they've agreed to so  Terms of service were pretty bad that my friend agreed to her data may be around for a long time  Even if they delete it. It's already sold to advertisers, right?  But what about data privacy loss you might be saying Mike that'll fix everything  Right well, my name is Mike. By the way, that's what you would say that  You know United Nations considers  Privacy a human right and there are different expressions of that most famous one is the GDPR  You've seen the Equifax stuff you've seen the Marriott stuff fines are starting to come in  So there's a little bit more attention being paid to that  But it's it's a good start, but it's not going to do a whole heck of a lot anywhere  You know in the near future and if you look at the larger picture  if you look at  Regulation worldwide  It's sketchy  right  There are a hundred and twenty or so countries with national  With national privacy laws either enacted or in progress  You have of course the GDPR you have which does fines you have PDPA and down the Philippines  Which does jail time for people and then there are the lighter colored countries  Including the United States of course, which has no national  Privacy law we have things cooking like CCPA and New York and there are at least six or seven senators that are trying to introduce  Legislation but again, even if they do you just do like a tax haven and go to the lowest common denominator  Where you don't have to protect privacy?  Which brings us  To  Pshin see I'll call it so we can't rely on enterprises to protect our privacy or to not sell our data  And we can't rely on governments necessarily to enforce things  So we need a third option  An option that will basically give my friend and us and others like us  the possibility of having privacy and to do that  We're gonna go back to sweaty man  We're gonna take our inspiration from the story of Spartacus and try and take matters into our own hands  However, horrific that might turn out privacy via obfuscation  And so what I did after I had gone through all of this  Is I started writing an open-source tool?  I called it Spartacus as a service a friend recommended that because the acronym wasn't taken and  So what I did was I used node  Because I vaguely knew JavaScript and I was looking for just the easiest route on because all I really wanted to do here in  The beginning was get a proof of concept make something see if I could alter advertising to see what was possible  So it's written in node that has the convenience of having the passport module which does all the OAuth for a  Lot of the services for you  So I wouldn't have to muck about doing token work per se  And then I'll talk about that last one in just a minute  I pushed the latest version to GitHub yesterday  I think so every almost everything you're going to see in a demo today is there online and you can download it  The tool takes three tactics and they are tactics stolen from location  From obscuring your location if you're trying to hide that there's a whole book you can read it about it  Called obfuscation. I think from Harvard Press  And there are three ways to do this if you think about location enlarging the radius  shifting the center and  Filling your channel with noise  Now these first two  Have to do more with creating  Multiple use or multiple whatever the target identity is and the third is a slightly different jam  So let's talk about those first two first  first  enlarging the radius  This is where you take the identity and you take one key attribute whether it's name or location or a couple of them and  you replicate them across  20 30  Scale up as many as you want to identities that look a lot like you  Sound a lot like you, but they're not quite you the idea here is the same thing as in top gun  Which is now a reference I can use again because Tom is making another movie  You remember he's flying along. He's being attacked actually every airplane movie ever and what they do they throw out chaff right to confuse the  Missile coming that's the same concept here. You're not making it impossible to find you, but you're making it more difficult  Second way is very similar except this time instead of a test text based attribute  We're doing it with images with faces this exists because of reverse  Google image search. I mean maybe it's just me, but who hasn't looked themselves up to see how popular they are or where they're  They're listed where they're what in action is about them. You might want to do that when you go home  The way to do both of these is actually pretty straightforward  The faker library is out there and that can generate a huge amount of data and save yourself a lot of time people use this a  Lot for unit testing in software development  sometimes for fuzzing  It can  generate from a database  Like I said quite a bit the tool at this point uses what's shown on the screen  Basic information using password email a URL link to an image  This library can also give  Account data fake transactions a brief bio background  It's pretty wide sweeping now note that things like it says older than 21 on the date of birth a lot of times  It will return a date of birth, but it's not going to put any restrictions other than it being in the past  So if you want to use this and have  Correlation between birth dates and death dates or anything else you're going to have to put filters on that  So for example, I put a check to make sure that data birth was older than 21 because that's just gross  So to take a look at that real quick, I'll show you here in the tool  So this is what it looks like again, this is just node running in an express  instance which makes it really easy and pretty to demonstrate in public and  Then you can either OAuth in which I'll show you in just a minute  Or you can come down here to create identity set and what this is going to do is it's going to present you with  Basically exactly what you would think you choose how many identities and then you put in  What you want common to those identities if you don't put anything in these fields  Then you get basically a JSON  Dump of all of the data you can see different names different addresses different phone numbers obviously  There's no real phone number email address behind these  But just FYI if I put in something  That I want common to all of them  Say a first and last name or if I wanted everyone to look like Justin Timberlake I could do that and  Now all my data  Matches up. That's probably really hard to see in the back  I'll have the same first and last name the idea here is it's facilitating those use cases and what I can do now  or I've done in the past is  I've taken that information  And  Now I want to process that in bulk now  This isn't quite finished. I tried this a couple times with Amazon's mechanical Turk  Which is great, but remember we're dealing with some kind of  Verification  In other words, there's gonna be some kind of email or some kind of phone based verification  Remember I said earlier that Twitter caught the phone number  Email is relatively easy. You could spin up your own domain  There are lots of email addresses that can be temporary and can be used and you can forward those to whoever's doing the work for you on  something like Turk  But phones are more difficult. They're catching prepaid phones  They're catching obviously Google voice if your number has been cycled too many times or too quickly  It won't work either from day to day Google voice has worked or hasn't worked  And I really I'm looking for a way to make this programmatic obviously temporary numbers  I'd rather not buy a thousand sims or anything like that. So if you have ideas  I'm all ears  Because I would really help this part of the project  Side note when I was doing this  When I first made my friend's profile and her backstory which I had a whole backstory for  This was a picture I used  This is not my friend  Obviously not the picture that I'm using today either  And I blurred her before because I'd like her to not be swamped and live a little bit longer in her fake existence  I use this picture and I was having a great time and posting content and meeting graphic designers in Austin who thought I was a  30 year old woman and then my friend called me up and he said hey Mike  You don't want to use this picture. I was like what what's wrong with using this picture? He said well  She's not a white space. She's not Greenfield. It's like what do you mean? He said well? Have you done a Google?  reverse image search on her I said no  Is she on you know a couple sites like 10 20? He's like no just go do it. So I did  25 billion sites use her photo and  As is obvious now, why is that because everyone's doing the same thing I was doing if you're writing a bot  Where do you go look for an image open source?  Stock photography because you don't feel like there's any licensing or any issues there, right?  Almost every actually everyone I haven't found one that's not like this that isn't just all over the place this  The picture of this woman has been used to represent  policymakers in Washington DC  sex workers in Nevada  There is a mystery  Novel writer selling books on Amazon that uses this photo on her website to represent herself  So  The big takeaway if you take away one thing from this talk  It's that you don't really need a tool  To obscure yourself to give yourself privacy of your image. Just be sure you're in lots of stock photography looking really happy and  Then every dream you have will be realized you'll be an author. You'll be a playwright  You'll be some other things too, but  And choose wisely, but that's that's one route you could choose to go  So upshot is lesson learned I changed the photo  So that is the the first two right and large in radius and shifting the center  Let's talk about something I find kind of more interesting to be honest  Which is the process I call filling the channel with noise. This is not creating new identities  This is just deluding the information that's out there about you on your existing  identities so that people looking for you or  People doing surveillance or whatever else has left and less of an opportunity to know what's real and what's not very similar  To the talk on tutorial fashion. We just heard  So basically it's taking something like this. My friend originally  was an avid reader and  And she ran every other day by the way if you're faking an identity choose repetitive hobbies  Dead simple to tweet about I ran five miles. I'm exhausted. I read this book really really easy  She's also searching for mattresses and looking to buy a Volvo which seems like an odd combination  except that those are orthogonal and  So I didn't think one would necessarily be related to the other and that way I knew if I got  Advertising which I started to measure if I got advertising for a Volvo  Then I had a good sense that it was because  She'd been searching for her tweeting about it and we've all had this feeling right  You know you're talking to a lot if you have one of those or your friend and you have a discussion  All sudden advertising is is popping up. Well the idea of this use case is to flood the channel  like I said with other things in this case I was using  Barbecue and politics and violins by hand basically to throw off advertising  To make sure they didn't quite know who she was what she was into and thus give her some kind of privacy  Now as you might imagine  Doing this across 24 apps is a pain right because you'd have to go to  Every one of these and to do this programmatically create an app on those and get an API key and all of that  So I started with three and that's where the tool is today  The first one I started with was Facebook  and  That was great  It was pretty easy and Facebook is kind of like the Wild West or it was you could a you could you  Programmatically put things on anyone's wall and it looked like it came from them once they had given you Oauth approval to do  So with your app  Good for Facebook. They realized that was probably a bad idea. So in 2018 they shut that part of the API down  For four months. I still had hope because they left the life events API open  So while I couldn't put content for them, I could have my  Target or my friend get married get divorced moved to Arizona  Have three children live in a bus down by the river and then they shut that down too  So Facebook is kind of a hard nut to crack at this point. You can you can put pages or links to pages on their  Facebook wall as if it came from them, but it is all based  It's an iFrame from from from Facebook and you can't pre-fill the text  So it's a little more complicated. I'm looking at ways to do an end around like with Instagram or something else because all I  Really want to do is influence that same  marketing pocket  Google is pretty easy  Pretty table stakes  Basically once you get them all off then the tool I'll show you here in a little bit  But it can go out and just do a search at a rate that doesn't get rate limited and counts as independent searches for Google  Because basically what you're trying to do, of course is  altar  Alter basically this page  This is an account I made earlier this week  And already it's decided basically almost out of the box that this is what he's into  Almost middle-aged male, of course, he likes football for some reason anyway  The idea is here. You're shifting this  This perception of the target  With those Google searches and the like now in the future  I was given the pretty great idea  This week that what you could also do is since Google historically although they say they're not doing as much anymore  historically has searched through your email and  indexed it to get flight appointments or  Doctors appointments or purchases and receipts you could set up a  Service where we could send an email to a Google account have a filter on the receiving Google account  You'd never see it, but it'd be automatically altering what they thought you were interested in what you were doing  And then Twitter  Twitter was the most exciting to me  Because that was going to be more creative than some of the others. I wanted a content generator  That I could use to generate tweets and I wanted it to be  Realistic enough to alter advertising and to be fun  But I also wanted it to be mutable and not mutable but mutable in other words  You could turn it off or filter it out  To do this. I originally used a mark-off chain generator  You can Google all these terms here in a minute. I'm gonna try and explain what I use but it's you know  Time constraints and all of that these these are great because it uses word frequency and goes kind of state-to-state and a state graph and  occasionally  It can produce really great stuff like this tweet from June  It says indeed Jane you ought to believe me  No one who has ever seen you together can doubt his affection or his admiration for the basting of pork ribs  Could she have seen half as much love in mr. Darcy for herself?  She would have been concerned with data privacy  So this is a mash-up with mark-off chains. The other thing you can do is you can combine sources  So this is a combination of Jane Austen  the how to barbecue from Aaron Franklin may he live forever from Austin, Texas and  the actual text of the GDPR regulation so  Not quite the best-selling fiction. I'm gonna be able to go sell  That's a different village probably  But the problem with this this is one tweet out of like ten thousand that worked this well  Which is why I took a screenshot of it obviously a  Lot of times what it sounded like was just too awkward  to  Not great and so I shifted to a recurrent neural network to do this  And the part that is because mark-off chains don't remember the full history  They just remember like it's someone with a really short term memory like someone with a severe head trauma  So in the short range it does great. So for example this sentence I  grew up in France speaking  French right pretty simple. There's not much gap between  the the history of the prompt and what you want the mark-off chain to fill in now  It has much more of a problem with something like this  Where there's more space where it's I grew up in France then I moved to Germany spent several years studying Basque pottery under a master  And then wrote a best-selling book when I was young I spoke  now other than being pretentious  This is a just a long sentence with more information and so by the time you get to where you need to fill in the word the mark-off chain  Just basically looks  Really close to where it needs to fill it in and so sometimes can  Do something totally weird at least that's in the ballpark. It knows it's a language  But it doesn't quite know what you're looking for so it takes a pot shot now a  Recurrent neural network will remember everything  In fact, it's being a house design. It will remember everything in your text  And so it can say oh well this is a continuation of what came before so obviously he's into French  So it bought me. I felt like more coherence  caveat at this point  All of this is just my experience my past training with mark-off chain generators and artificial intelligence  intelligence is like zero so  May have just been doing the execution of this wrong  But it also gives hope to everyone in this room to be able to do the same thing because I'm just using kind of off-the-shelf stuff to do this  so  The neural network like I said, it's time series based machine learning has a long-term memory  You can train you can rent GPU time and train it and then you can have a model that you can use wherever you want  To be able to generate this kind of content whether it's JavaScript or node or whatever else  currently available in the tool  Is this cast of characters some of this came with the the open-source?  Neural net base some of them I self-generated so you have things you  Like Hemingway and Darwin  You have the boy you have her mind his mom  Obviously you have Aaron Franklin, which is very specific to me. That's the barbecue guy at Austin, Texas  let me know if you need a brisket later on and  things like  No, every state of the Union from the beginning of the United States  until about the Obama years  Because no one needs that extra  Extra words much better like that  To train a model I used something called  Paper space again because it was easy. This is a GPU rental facility. There are many like it  I have all the the instructions here  You can have them later to go and do this yourself basically you you download the package and then you go and you find your text now  Your text you can go to Gutenberg. I did it earlier  Where I downloaded today actually I downloaded the Sherlock Holmes complete works  Really it's any text you want it needs to be if it's just utf8 text  It needs to be about  500k or bigger for it to start to be viable the cool thing about  This type of neural network is that it learns syntax and format as well. So if you fed it  The source code for a library it could start giving you source code back  It wouldn't necessarily run and who knows what it would do, but it would look pretty cool  So after you run the job  It goes out there and does it gives you feedback as it goes and it trains it up  and  Then what you do after that is you wait and  Depending on how many how long you want to train it  It takes a little while it I started one earlier today. I'll show you in just a minute  Like I said, it was Sherlock Holmes. It took 35 minutes and cost me a dollar or 50 cents  So very easy to do very viable  Like I said anything any text you have it would work  Yeah, you go out and you download the model you put it in a particular file  In the Spartacus tool and it'll automatically pick it up from a drop-down list and add it to your sources  So like I said what I wanted to do is I wanted to flood the channel with noise  And started in this state and then started altering it in part with the tool and some by hand  And let me show you what the tool actually looks like here  So we've seen this before except this time  We're actually gonna owe off in with an identity I created a couple days ago  You see Twitter he's already logged into Twitter so he kicked back  And so now he's actually logged into all three and it linked them in a in a common session because I've been using it all day  Facebook obviously doesn't do anything at the moment, but Google and Twitter do  Like I said what Google is going to do for now  Is you can choose from one of the models that are in the system that come with it automatically when you when you clone the repo and  Then you can choose whatever it is for example barbecue and choose how many repetitions you want it to search for it to alter your  Search history and then it goes out and does it this is a lot like Selenium  As a base, but it's still in the package and so you can go out and do whatever you want  It will start altering  What your search history is and how Google thinks of you in the background so simple case for for Google now  Twitter  This is a little bit more interesting because it's using the recurrent neural network. I was talking about so what you do is you choose  What model you want to use and then you give it?  Sorry starting to try then you give it a  Prompt in the words you give it a seed text because it needs something to start somebody give me a five or six word  half sentence  That was the fastest response I've ever gotten thank you  And then once you hit the reset  It takes a shot at it  So what's my horse I useful seed there's sometimes it works really well this is a lot better than Markov chain was  Sometimes it sounds like someone fell on the bathtub hit their head and started tweeting about it  but and Harry Potter can be a little creepy because  Actually if you do it too quick it does that because the history blows up  There we go  because you know it's  It's talking about children  If you do someone like Hemingway you tend to get  Wow that was really odd  You tend to get shorter sentences. There's more violence and more alcoholism in general  Shakespeare is interesting because it's a play and remember it does formatting  So a lot of times  You get lines and sometimes you even get stage direction, you know exit stage left eaten by a bear or something like that  Which you may or may not want to tweet about if you do state of the union  it gets the opposite it gets really long and  I mean picture yourself sitting in Congress. That's that's the experience you get right it's  Clause after clause regardless  You'll also note that there is a prefix tag here, right?  What that is is that?  Mutability I was talking about before where you know you don't necessarily want to flood  Your Twitter account or your social media accounts with Harry Potter fanfiction. That's just kind of weird  So when you hit the obfuscate button, what will happen is it will go out and tweet on your behalf  And we can see it  You can see it microscopically  So you can see that it  It's been tweeting on my behalf off and on all day  But there's a prefix and so what that means is you can tell people you care about and that you don't want to infuriate  You can say look set up a mute  Function for this string so that you know this didn't come for me and I'm not crazy insane  Which is helpful  Remember this is also  These are also all  No based still I have not it gives the opportunity to transform these into web services  But I haven't done that yet  That's kind of one my next steps to make it more programmatic so you could script it now while this is for Twitter  This has a wide range of applications for some of the other social media apps anything that that relies on  Text-based content creation that sort of thing  Could use this and so with that passport module on node you can actually  Set up the authentication once you get the API key you can set the authentication rapidly and then you can add on those modules  app by app and very quickly build on  What's already going on?  So over time I did that with my friend and  in her ongoing saga here and  She started to look more like this  she was really into brisket and pork ribs for a while and  Just sounded like a crazy person talking about national problems because she was sometimes liberal sometimes conservative and sometimes just  Really bad politically informed and then I I manually added on violins just to give a little more color to it  Over time and this is really hard to see in the end  What I have here is I wanted some kind of  Sciencey feel to this so as I was doing it. I was measuring  manually at this point  Well, how advertising was changing over time so before Spartacus we have BS and AS  Before Spartacus and after Spartacus  Beforehand she was really getting a lot of  Stearns and Foster  Tempur-pedic those kinds of things and she was really into the C90 Volvo or something over time  That actually dropped and so mattresses dropped from like 50% of the advertising down to about 15  now keep in mind this was me doing it every day for like three or four weeks, but  Upshot is it actually changed  How?  advertisers  Viewed her who they thought she was what they knew about her was now different  She had other things obviously the things that was actually pumping content out and searching for  Started to influence it in about 18 hours after I started  She started getting advertisements for full on  Displace smoking units for barbecue which she didn't buy but it was helpful  So this should be your next question  You should be thinking Mike this is this is fun  But is this practical does this have any value?  Twitch our play yes and no right both end you don't necessarily want to flood your  Social media life with crap you might you know, that's your own issue  at the same time  this kind of  concept  Replicating yourself to hide who you really are and your identity  Creating enough content that no one can tell what your true content is or even filling fake accounts with fake content has  Applications think of of people who are being stopped or people who are being sought after  Someone who's searching an ex or an ex partner searching for someone across state lines trying to find out where they are now  What their life is like now to be involved in?  That is a great question the question was does the Twitter API allow you to do geolocation  I haven't looked that's one of my next things to do is to actually  Spoof location now keep in mind. It's running locally  And it's just doing an OAuth so that I think a VPN would come into play because as far as Twitter knows you're tweeting in from  Whatever that is so buying programmatically we better and more efficient  That's good point  In addition to personal issues  You know in 2017 the United States government announced they were going to start requiring  Social media accounts and people applying for visas or coming  Into the country and in June they announced that any social media accounts you've used for the past five years  You would need to turn in to the government so they could review it and look at it  So there's a potential application there like a set of fake accounts or fake content  as a way of  end-rounding  violations of privacy in that way more recently still  In June of this year there was a  Journalist who came into Austin, Texas my hometown which personally applicable to me. It's very  Lovely to come into costumes in Austin usually I hardly stop walking  It's like ten minutes, and I'm out if I have a carry on this guy came in got stopped  You can read the story in the intercept was held for  Five hours they went through all the stuff all the social media accounts  So it's it's this kind of thing and even five days ago the EFF  Released a latest report on what this means and what the implications are for people looking near social media  Whether they're doing it for a job or more particularly in this case in immigration  And even if there's not a special situation where someone's in danger or it's a refugee seeking asylum  Who's afraid to give their accounts because they already fear violence back home  It's not a foreign concept for anybody, right? This is a quote  First scene in Banksy graffiti  first attributed riff off of anybody remember  Andy Warhol everyone will be famous for 15 minutes  What's the kicker on both of those stories?  Neither one actually did either of them  Warhol didn't say it and Banksy didn't draw it  But it makes a cool story, which is the same kind of vibe here, right?  What what I like about doing this tool and what I like about telling the story of Spartacus and in fact  using stickers to do it is  That people get it right people that are not in this room people that are normal that aren't concerned with security  They don't say oh, I have no idea what you're talking about. They say oh, I I want that how can I buy that?  How can I know more about that and so that's the power of a story like Spartacus?  Is that it gives us a chance to advocate for them for people who are in trouble but also?  to be like Kirk Douglas or his friends rather and  Help have those discussions so that people around us know more and are empowered to protect their own privacy through obfuscation  Thank you  All right  If you have any questions for Q&A, I am walking on up to the podium  Please make a orderly line or a disorderly line in light of the slave revolt theme here  Nobody else has when I have a question okay is your tool available in the Russian language  The faker tool actually flips whatever language you want you can set a locale so yes  It's already internationalized for your use and accept now the tool itself is not translated to Russian  but  Question oh  Given that the like Twitter and Facebook are cracking down on oh this way  Oh given that apps like Twitter and Facebook are cracking down on fake accounts. Does that ever is that is there a potential like?  If you start putting garbage on there, they tag you as I think that because the way the Twitter  The way it tweets out  It marks where it came from. I'll show you  How so  That's true if they thought you're fake and they deleted you but he's I mean in my mind the question too is they could block the tool or they could block any kind of faking mechanism  To do it as well and it's identified, you know as whatever this is but most people don't look at that in terms of purposes  But yes, that's one of the things my concerns was using it too much or too quickly  I mean, I think it's a good idea to use it as a tool to help you out  That's one of the things my concerns was using it too much or too quickly of being flagged as a  misuse of the API or or whatever else  And thanks  Could it be extended to be used?  With automations tools like Selenium something like that. Yeah  Well, the the the first part definitely where it's polluting search history and doing that sort of thing. I think that  the  You could do the tweeting part of that as well in other words the mechanical putting it on  Social media or the account but the creation of that content would still need to come from some source  And so that's either pulling, you know pulling text or pulling content from a database or a repo or dynamically generating it like I'm doing  So yeah, the Selenium thing has come up a lot this week too for sure  If you preload a database of images  Like that would require some manual work to collect them and to make sure that you're not getting absolute garbage or something extremely offensive  But could you then port it to something like Instagram and just have it upload the image with a text document and yeah  Yeah, I've thought about I've thought about that already and the the faker library actually goes out and you can tell it a  set of eight or ten different  Topics that it would pull from and give you images loaded but that's coming from a database  But you could do the same thing like others also embedded in the tool  Is a script to go out and download a hundred faces from this face did not this person does not exist  Because that didn't come into being until after I'd already started the project  But that would be helpful too because you need something that's usable imagery with those accounts and those identities  And the other questions  Have you been working how long we've been working on this to develop it not that like a  Year maybe year and a half playing with things  But probably a year of doing things but it's been I have a day job  So this is and three small children as I dox myself  But so it's you know, it's been a while but  Questions  All right one more big round of applause for Mike
Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_0_1079.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_5280_7163.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_7164_10835.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_10836_11639.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_11640_13811.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_13812_15107.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_15108_15347.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_15348_16331.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_16332_17519.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_17520_17963.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_17964_18179.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_18612_19907.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_19908_20915.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_20916_22787.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_22788_24539.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_24540_24647.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_24648_24695.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_24696_24755.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_24756_25115.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_25176_25283.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_25284_26675.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_26784_26855.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_26856_27299.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_27300_28859.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_28860_30227.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_30228_38111.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_38112_38279.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_38844_39023.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_39024_40631.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_40632_46343.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_47460_50543.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_50772_50843.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_50844_50891.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_50892_51143.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_51144_51995.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_52092_52379.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_52380_56015.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_57012_57095.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_57096_58151.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_58152_58211.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_58212_58307.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_58308_58355.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_58356_61139.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_61140_63575.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_63576_66131.png Mike_Kiser_-_Ensuring_Privacy_through_Obfuscation__U1wb4_bIVbc_69828_74250.png