They Don't Need the AI to Spy on You. Are They, Though?

Hello everybody. How is everybody doing? >> Well, are you have you had enough yet of this optimistic theme? Very optimistic indeed, isn't it? Yeah. So, I wanted to show some love to uh to side channel um uh to side channel attacks because they don't really get talked about as much and they are quite relevant. So, that's what the talk is about. So yeah, you know, like thanks to the AI, well largely like well surveillance issues are getting media attention and they get more media attention than they normally would. So that talk was inspired by by two news stories. So one was about facial recognition being rolled out live by to all the police forces in the UK

and another was about Wi-Fi and how wi how AI and Wi-Fi can track you. So basically what the way it works it can the Wi-Fi if you are in the vicinity which there's Wi-Fi everywhere it can rec it can accurately recognize you and with the help of the AI it's like n 90% 95% accuracy and well obviously this this sort of stories make people be a bit spooked and scared of the AI itself but I'm here to tell you that you don't have to worry about the AI because it's been that way all the time really so I'm not sure if that's particularly you know um particularly optimistic but uh I do appreciate the role that these stories

play in raising awareness but yeah like to the point so uh however grateful I am for well the AI bringing attention to surveillance issues the AI in the current form because there's there has always been some sort of the AI it's just like these days it's more ubiquitous and more sophisticated uh wasn't even needed like the technology ology that I'm about to describe has been around for quite a long time for 10 15 sometimes 20 30 years. So uh so yeah so what else have we not considered like in the main discuss and what makes Wi-Fi and AI such a creepy combination? So I'll explain just that. So basically the problem is everything is electromagnetic

spectrum like literally everything like it's just uh it's well what Wi-Fi is obviously it's radio and even our vision well the visible light is electromagnetic spectrum. So basically we have built-in as humans built-in sensors that can detect a portion of electromagnet electromagnetic sorry spectrum and we can analyze it but well obviously it's limited we don't see everything so that's how how it works and yes I'm talking about our eyes so there so we can detect texture due to how electromagnetic radiation which is visible light is reflected from and basically that's kind of how it works. So like when it comes to visible light, well, light shines upon something and it's reflected. So the way we perceive

it as well, there's something in front of us. For example, a car driving right towards you and we can perceive its color. So its color is basically the wavelength that it reflects and uh and yeah, its shape as well. And well, radio kind of works in a similar way. It's just a it's just like you have radio that's sending those signals and the objects in the way they disrupt that signal and we and while the sensors or the radios can perceive that and I and well that can be used to make some sort of interpretation of what it is like what sort of object like the density of the material uh shape etc. So yes, so

there's that and so well given that Wi-Fi is everywhere and while electromagnetism is everywhere and it can be analyzed that's how it becomes a problem. So uh so why Wi-Fi hates you? Because it does like it will betray you in a second. It's well it will sell you to the lowest bidder. So, uh, obviously when you when you walk through the shops, um, uh, well, Wi-Fi is able to detect where you're going and how much time you spend in each aisle. So, that's called the dwell and how you move between different access points. So, there's that. So, you can also per the dates the data that Wi-Fi collects with unique identifier. For example, you can

use so-called captive portal. So you know if you wanted so for example you can log into Lancaster University Wi-Fi and there's captive port and it asks you to use your e use your email and put in your lane that's captive portal and that can be used to uh track information about about you create identifier and to use it for all sorts of marketing purposes. So like for example uh the in case of a grocery shop like they would know uh what sort of aisle you're in and that you really like and they can compare that data to what you actually bought for example based on sales data or if you have a store app installed

then on that data and they can tell that you really wanted to buy that bag of chips like walkers uh well salt and vinegar but you decided not to because it's not healthy for you. They really know your temperature so they can send you a coupon because they know you're weak. So there's that. So and yeah, so you thought that they just made Wi-Fi available for you other goodness of your of their heart. Are you serious? So yeah. So um also like these days, well to be fair, everything is monetized. Like if if if you breathe that's monetized as well. So, uh, there's a lot of potential of abuse for abuse because this information, well, I'm I'm kind of

saying saying all these things in a tongue and cheek way, but like this is actually betraying a lot of information about your lifestyle, like what is it that you fancy? What is it that you're regularly buying, like what shops you're visiting on a regular basis, you can pre you can pretty much recreate somebody's day based on that data and compare and well and pair it with a unique identifier. So that that's well that's a useful information for insurance for example for a burglar I would say that's quite a boon. Uh I'm pretty sure life insurance would want to know that you have unhealthy habits and perhaps raise your premium if uh you're found hanging around for too long around a cake. So

there's that. Uh obviously they wouldn't tell you that but they would love that info. Um so yeah so it can be also been done more directly like you just like for example like you just went past I don't know Cadbury chocolates if this is your if this is something you fancy and then well it can send you a coupon for that for example or like two buy three for the price of two so like bit more bit less sorry sophisticated uh so yes so well there's also Bluetooth is a well it's a radio frequency frequency as well. So yes, it is bad for you. So the way it works, well, it's pretty straightforward. So it's a uh so

you we're not going to discuss that in too much depth, but shops use that. So basically they have Bluetooth beacons and you walk past them and funny thing how that works is that they don't uh those beacons don't uh don't gather any data directly from your device. So it's your device that gathers the unique identifier of the beacon and you pass a lot of those beacons. For example, you go for the shop. So you pass the entrance, you went to the uh you went to the ambient IO, you went to the fridges and it and if you have an app installed for the shop. So it gathers all those identifiers because it can like you

can't limit that type of activity. it can record those and they can recreate where you were in the shop. So, well, works out pretty much the same way. So, then the app will send it to the servers of the shop and the the shop servers will either decide to send you some sort of information like for example prompt you to use a coupon or uh perhaps or perhaps uh send send you some uh other information about like what's going on in the shop. something that it will figure it's relevant to you basically. Uh one thing is like people think that if you switch off Bluetooth uh it eliminates the problem and yes it does to a degree like that's my

huge beef with Samsung because on Samsung and I think it's Xiaomi phones as well if I am pronouncing it correctly. uh even if you disable Bluetooth like you in order to disable uh gathering or all the identify your data you have to go like mess about with uh battery saving settings. So there's that. I will get to that. There will be a side that will show you all those things and how you can switch things off. Uh well on the iPhone well yes switching off Bluetooth not popping up that uh thing in control center but like switching Bluetooth entirely does help. So there's that. Okay. So, um yeah. So, there's a so what's okay. So, what is it

that Wi-Fi can actually be used for and like without any sort of AI? So, it can recognize gesture. So, there was one such system. So, it's called it was called YC or WC however you want to um pronounce it. And it can distinguish between two different people as well. And what it was made for initially was recognizing gestures. So like you could for example do that to like switch up the knob uh sorry to switch up to like turn up the volume like as if you were using a knob or like you could uh uh use it for smart home um for smart for smartphone management like to draw the curtains or switch the lights off with a

gesture. But obviously if it can do that then it can recognize what you're doing in your own house. So uh it can have less innocent users as well. Um also is also like uh uh what do you need in order to have that functionality? And the thing is like any odd router would do. It's just a matter of tiny software update. And there are companies that in well that's in the US that actually use that for their own benefit. So there's company called um so there's company in the US and they are called Xfinity. So they have an option for you to use Wi-Fi in order to detect presence in your house. So yeah, quite handy. Like I like

I can see how that could be useful. So instead of having an alarm system, you have just your own Wi-Fi and if somebody pops through the door and you don't remember uh allowing well handing keys to anybody then you will then it can trigger the alarm but they also gather that data and aggregate it and sell it to data brokers. So so uh yes so there's that. So there's not only that project. So um n about 9 years ago a company called designer was established and that company created something that they are now offering for sale. So it's called like a u physical layer of the AI. So they use 5G and Wi-Fi or basically radio

technologies that are commonly used these days in order to map the uh map the entire cities down to down to every tiny object in your house. And this is quite accurate and they are offering it to both government agencies and well in general like anonymized data for analysis. How anonymous the data about your own home can be? Well, it's up to you to decide whether that's what you think of it. I'm not going to tell you what to think, but uh this is this is a thing. This is happening and this isn't really as sophisticated as it's made out to be. So, well, yeah, we are talking about crisps habit, right? So, these can hear you as well. And this is a bit a

bit of a more obscure thing. So, not only do they drag you to your pre premature death if you exceed well appropriate consumption levels, but they can hear voices quite literally and can it can be used to record conversations. And this is actually quite fun how it works. Again, I'll remind you this is no sophisticated AI, no chat, GPT, no nothing involved. So, basic so basically what you do is you need a camera and the tests uh from this slide. So they were performed in a totally soundproof room. So the window is well actually I would call it balcony door to be fair. Uh so it's totally soundproof and the and if so the way it works so if you ever like

if you were a kid and played with the tin foil you know it makes weird noises when you speak right next to it and it's a similar thing. So even the tiniest noises make the bag of crisps vibrate or any like flimsy object. Well, any object in in general and because and it's imperceptible to us, but cameras do and do see it. And if you have high enough uh frame rate, then well, you can just make a recording and uh you don't even need to need particularly high frame rate. So they use two so the researchers used 2,000 frames per second but like for comparison well speech is usually between A2 to A4 so that like in hertz

that would be like between 110 htz and uh 440 htz so that's way below 2,000 frames per second. So you need that fre so you need that fra frame rate frame frame rate sorry to match the frequency and then you can analyze it and well actually well to be fair like forget everything what I said you know like due to how you don't really need such a high uh such a high fps because uh the way most of the modern cameras work they don't take a p picture of the entire scene all at once like the way we see something and the way old cameras like analog cameras worked. Uh so this is called so what it's called is rolling

shutter. So you can either have it like spinning around but like in phones it's most like scanning like line by line like going down like this. And due to distortions that produces you can actually use an ordinary phone camera in order to recover or in order to recover sound. So yeah. So here we go. So all you need is pretty much any modern smartphone to you and for somebody to be able to eat drop on you. Well, provide provided that you're eating crisps. Actually, no, sorry. Even if you don't eat crisps, like they also did tests with objects like plants for example. So if you have plants or if you're eating salad, you're not that much better

really. So yeah. So there is that. So u yeah. So is Wi-Fi is bad? Is all radio bad? And yes. Well, so yeah. So if you think that you're in front of a PC that has no Wi-Fi access, has no wireless network card and uh uh well and if you think like okay so they can't catch me, nobody can ease drop on me. Uh I would probably ask you does it have a display that computer probably yes and if so sorry you're cooked and how how that how that works. So um that's quite easy actually. So the problem is similar in a way. So obviously like well what monitor any monitor emits is light electromagnetic spectrum. So, it can be

used to eaves drop on you as I said earlier. And well, also monitors emit a sound and if you're as old as me, you might have even had a CRT TV or monitor in your house and they do make that white noise. And those actually also make those noises like this one, this iPad as well. We just well we just you kind of have to admit that humans hearing sucks and like animals are superior when it comes to us when it comes to the range of frequencies. So they do make imperceptible noise and depending on what pixel is lit up there will be variation. So you can rec so you can and well we can't hear it but

microphones can and they will record it and you and you can analyze it and well read what's on the screen. So yeah. So, so there, so there's that. But yeah, so and if you think that you need like fancy microphone like the setup that Cooper like set up for us very kindly here, you would be wrong. But again, like just a very basic microphone for that headset for that you can get for two pounds from Teemo is sufficient really for this purpose. So yeah. So there's that. So yeah. So, how how does everybody feel about this now? So, yeah. So, yeah. So, well, um so yeah. So, you're not going to eat crisps. You're not

going to use radio. Um so, on your premises, so you're probably going to only Okay, thank you. Eat organic and fine. Hope. So hopefully you have fully inaccessible source of energy if you're intending to do that because energy can be used to used to spy on you as well and uh yeah so meters can spy on you and this is and well you might have heard about push back against smart meters and this is for really good reasons. So they gather something called halfhourly data. Well and this is well this is the default. You can change uh how often they gather data if you speak to your energy provider, but this is the default. And the energy providers say

that this is anonymized. Absolutely wrong. So you can well it's just the pattern of energy used like energy spikes combined with times at which you use energy is so unique that you can trace it back to each meter point. I'm not saying each household because like sometimes households can have two meter points but yeah. Yeah. So, so yeah. So, if and the problem with that is that energy providers and regulators actually move towards more transparency with this sort of data. So, as as in they look to share with everybody like all agencies for research purposes for uh managing the energy use and tariffs etc. Uh and well even well even if you round up the

numbers you still can be identified from your energy use. So there's that. So sorry no electricity for you guys. Uh so there so there's that and uh well again like it's quite a boon like these this sort of data for all sorts of companies who want to monetize and target you and for government agencies as well. We'll get to that in a bit and but it's not just that like using energy well if you use energy you lose some and and well through heat and heat leaves a trace. So the mobile cameras can be used and uh they can tell like what device was on and how long ago was it switched on or if it's off. And speaking of the thermal

cameras, well we they can also pick up what we were touching around the house. They can be so precise. So for example, if you're typing your password, well the camera the camera can be used to analyze what what key keys you are using. So if what they found actually is if somebody like counts and pecks on key on keyboard then it is more reliable but it's still well can be used to identify what you are typing and also well sound can be used for that purpose as well. So even a recording from your zoom call when somebody hears you typing well that can be used to identify what keys you are using. This is more reliable methods. So, I suppose

you shouldn't type in any passwords while on on a call or ever in case somebody overhears you using a bag of crisps. Uh, yeah. So, there. So, there's that. And yeah, you also don't want to use any light and use any light bulbs and Yeah. So, do you want to cancel your with your contract with energy provider yet? >> No, you're still good. Yeah. So, okay. So, it's not it's not that easy. Well, I I mean, well, it's relatively easy. Like, it's still within the reach of average person. So, all you need is a telescope. And actually, I have recently seen one uh at the charity shop where it was uh it was about £50. So, I'm I'm No,

I'm I'm for the record, I'm not I'm not using it for anything. But well, so uh so you know how you were discussing sounds just recently, right? So sounds make will also uh influence the light and make it make the light bulb vibrate. Thank you. And when and you can I again record that pattern or like even use it live. So you direct my the telescope at the window of some of somebody you want to ease drop on and it's and you put the sensor in front of the telescope and it reads the signal and it recovers all the sounds for you. And this is actually pretty accurate. So yeah. So um yeah, I'm uh I'm not turning it switch off

device. Well, sorry kidding. Well, it's recorded anyway. So yeah. So I can could easily go on about it all day. Like this is like there's loads more attacks as such and these are really accessible and these are really cheap to do. But is it is this even legal? And well the answer actually kind of yes. Well, there is no precedent uh about using such data to for example target somebody to surveil somebody. But the thing is like well surveillance is called by the harassment laws like well unauthorized surveillance of course like by stalker or somebody uh but uh one thing is it's very difficult to prove like those methods can be used quite covertly and nobody realizing so

good luck proving that and getting the authorities to investigate and the other like you could argue in theory that this data is public. So unless somebody actually goes to the court or there's a specific act of law, it's kind of a gray area legally. So there's that. Uh and well, I hear you say talking about shops. Well, there's GDPR. They're not supposed to collect it. And I've got a really bad news for you because well, these because these days by merely like walking into the shop or by the shop, you agree to their privacy policy and to their terms and conditions. So well and this this sucks because like well you don't read terms and conditions before

you leave the house but unfortunately that's the reality we live in and so far it's sufficient for all the regulators. Um so yeah if u and also if you want to protect yourself by jamming the radio signal no you can't. So they can do all those things they can surveil they can spy on you. You can't protect yourself. This is illegal if you use radio modified radio equipment without ofcoms authorization or if you use jammers. So yeah, so there's uh and are so again so are those attacks used by any government agencies? Actually yes. So obviously it's difficult to tell because it would be an interesting freedom of information thing but uh NSA for example used to

listen on encrypted facts tax faxes sent by European Union agencies. So well they didn't really crack the encryption they used they basically used uh the uh they basically recorded the sounds that Pax made and then recovered. So they kind circumvented encryption as opposed to decrypting anything. So and yeah so and also you would think that the data that I was discussing for example have hourly data and all the data about us about our habits that's well agencies that have access to it would usually be like police like investigating very serious crimes and no so if you want to take so if you want to take a screen grab this is all the agencies that have access

that can request access to your halfhourly data and other personal data in order to conduct all sorts of things. I'm not going to go in depth because I come on. Yeah, I'm not doing that. So, so there's that. But yeah, if you think like it's just for serious things, you're gravely mistaken. Uh so yeah, so what are we doing now? So because like what's the point? Like do we do we just like do we just all dig a hole for ourselves and just say that one and what it's up so well you can go dark like you can you can just like live in a hole or well you can take some basic steps again you're welcome to take a

picture of this slide for further reference like what steps can you do to minimize tracking and well this is something I want to highlight because it's not foolproof it's not it's not stopping all the tracking that shops too. So there's So there's that. Okay. I'll wait for everybody to take a picture. Yeah. Okay. All good. Okay. So yeah, but uh basically so I think the way to address it is at the source. So we need more transparency. I'm a really big fan of transparency pretty much. This is something that I promote in every single talk of mine. But I do think that being more engaged basically it does help. So like we need more oversight over this these things

like we can't really like we can't really all live in bunkers like that's unrealistic and we want to use that technology that we've got but we need to be able to decide whether the use of it is proportional and uh it's up to us to make up our mind about things but like it's just about being engaged in the process. So like well first of all like if you vote well don't vote just on vibes really and that's how people normally vote like read the policies read the manifesto if there's something controversial coming up actually instead of like reading the summary take some time to read the actual regulations so you make up your own mind because

because like things get skewed by by reporters who report on all sorts of things but you need to make up your own mind about things and you may perhaps agree with some of some of the users of techn the technology. It's all up to you. Like I'm not even here to tell you like what is right, what is wrong. So there's that. Uh well, obviously if you disagree with something, it's a good idea to attend protests or like sign petitions in favor or against something. There's that. And the last option well is like hold your politicians accountable. Like even if the MP that has been uh that is in your constituency is not the one you h you you wanted the

it's their job to still represent you no matter what political persuasion they are. So like hold them accountable, give them a call, like uh attend the surgery. Well, just like go speak to them or like make just make your opinion known. And I know like one person isn't going to make a difference, but like if a lot of people voice their disagreement with something, then that's when it works. So that's what I encourage you to do. I'm really a big fan of it. And yeah, so I think we actually did a good job. Did I Well, did I go over time? we go break. >> Okay. Yeah. So, yeah, thank you very much for listening to me. So, I really

hope that it encourages you to go deeper and to research these things for yourself and uh if you want to get in touch or if you have uh or if you remember some questions that you didn't manage to ask then by all means you can contact me uh through social media. Uh do we have for any time for any questions? >> I think we got a bit of time perhaps one or two questions if there's questions in the audience. There's okay right over here. Um you will be using a microphone. the lights will be on. Uh, so be careful with what you say. Let's go. >> Uh, so since we can't stop using all the

stuff, what if we just double down and use it in such an erratic fashion that the data does not make sense anymore? >> Sorry, say that again. >> What if we just double down and use it, use all the things in such a manner that we generate so much data that it does not make sense anymore? Like, >> well, to be fair, that's not how it works. Like the more you use the technology, the more and the more data you generate, the more uh the more the uh the more you can learn from it and more precise and actually more precise uh conclusions can be drawn for data. So I so I do get where you're coming from,

but I don't think it works that way. >> I think there's one more question here if that's right. >> Hi Ka. >> Hello. >> Do you have a good uh bunker distributor that you'd suggest? Well, actually, well, funnily, funnily enough, I've read an article about uh them becoming quite popular recently, and it sets you back at only well, the prices start at only £300,000 if you can. Well, so yeah, quite uh quite cheap and well, provided that you have your own land. So, well, I can have a look for it if you're interested. And if you have spare 300,000 quid, I don't really uh yeah, that's personal information, but there you have it. That's how much I betray.

But the pattern of life if you're buying a bunker means other everyone else knows you've got a bunker as well. So you need to watch out for that as well. >> But you need but well but on the point like you need independent energy supply. So I don't know how much that is going to cost you. So there's that. Sorry. >> Well you can well I've seen it on the internet so it must be true. Like if you have a cat and you have a bread and it's buttered on one side and like you put a bread on the cat and uh and well you get basically infinite energy like from the spin. >> So yeah, I think you can try that. I'm

not borrowing my cat though. But I'm not lending my cat for the purpose though. Sorry. >> Yeah, she's in the spot. >> Before we start questioning the privacy details of a cat, I think we should stop there. Um I'm getting a nod from the team outside. It's time to go for a break. So can I ask you first of all to say thank you to Kinger for a fantastic tour. Thanks for having me.