112. How To Protect Your Secrets: Inside China’s Technical Surveillance Playbook (Ep 1)

For exclusive interviews, bonus episodes, ad-free listening, early access to series, first look at live show tickets, a weekly newsletter, and discounted books, join the Declassified Club at therestisclassified.com. This episode is sponsored by HP. Most people are not counter-espionage experts, but that won't stop them getting targeted by cyber criminals. seeking to extract their secrets. HP understands that approximately four in 10 UK businesses have reported cyber breaches.

in the past 12 months alone. That's why HP business laptops, desktops, and workstations bought directly on HP Store are secure straight out of the box with their endpoint security. No more stressing about... dodgy emails or unexplained pop-ups, HP's independently verified Wolf Pro Security works alongside your existing security tools to protect your business, users and reputation from malware and evolving cyber threats.

with your first click. You don't need an alias or a secret hideout to stay safe. Just WolfPro security working tirelessly to protect your hard work. It's security that's built in, not bolted on. Find out more about how HP can protect your business at hp.com forward slash classified. Podcast listeners benefit from a 10% discount on all business PCs, printers and accessories using the code T-R-I-C-10. Terms and conditions apply.

And the next, they don't fit into the tiny sneakers they took them in. You blink your eyes and their princess dress is two sizes too small, and their dinosaur backpack isn't cool anymore. But don't cry because they're growing up. Smile. Because you can profit off of it. For real, there are a bunch of parents on Depop looking for the stuff your kid just grew out of. Download Depop to start selling.

listening to this podcast smart move being financially savvy smart move another smart move having state farm help you create a competitive price when you choose to bundle home and auto bundling just another way to save with a personal price plan like a good neighbor state farm is there prices are based on rating plans that vary by state coverage options are selected by the customer availability amount of discounts and savings and eligibility vary by state

If we are to remain an effective intelligence service in the 21st century and keep the identities of our agents and the tradecraft we use to run them secret, we must continue to modernize and adapt. Welcome to The Rest is Classified, I'm Gordon Carrera. And I'm David McClaskey. And that...

was the former chief of MI6, Sir Richard Moore, speaking in September, just days before he stepped down as C, the head of the British Secret Service. And he was issuing, I guess David, a stark warning about spying.

die and we've got a special two-part series starting today on how technology is transforming the espionage business for which we're joined by a very special guest who we'll come to in a minute and David I guess one of the consistent themes in our stories over the last year has been the intersection of espionage and technology, whether it's China using LinkedIn or Mossad trailing Iranian scientists and using robotic machine guns or...

North Korean cyber bank robbers. So this is a chance, isn't it, to look at how tech is reshaping the human espionage business. It's going to be a fascinating exploration, Gordon, of what's actually going on. now in the world of human intelligence operations. And just to sort of tee up a few themes, which will...

get much deeper into over the next couple episodes. It's probably not an overstatement to say that a lot of the tradecraft that we've talked about, particularly in some of our maybe more historical series or stories that we've done.

The tradecraft that we've discussed is now, I guess, maybe totally or something close to totally obsolete. There is an absolute revolution going on in the way that human espionage operations are conducted and that's everything from how you spot assets to develop them, handle them, pay them, communicate with them, meet them face to face, the entire sort of spectrum of

interaction with other humans who have secrets that we want is being reshaped by a lot of the technology that's all around us every day. And I think that's the other piece of the story that's so interesting is that... The technology that we're talking about is not tech that's secretive and hidden off in the world of the NSA or the CIA. It's tech that's all around us and a lot of the tools and technologies that are reshaping.

human intelligence are available to everybody. Everyone is kind of worried or thinking about issues of privacy or privacy and surveillance and what's going on with their phones you know am i being tracked who's following me can i track my kids you know all those kind of questions are part of everyday life for many people but

for spies, for people trying to carry out secret work. They take on this kind of added dimension where you basically can't do the business without them. So we're going to do something slightly different. We're going to kind of look at this subject, aren't we, through these... two episodes and kind of dive down deep into it rather than telling a single story we're going to look at

different aspects of this. And we've got a great guest who can talk us through the aspects of human espionage specifically and what's going on. We're not looking at cyber spying, for instance, but really the human intelligence business, isn't it, David? We're not talking about offensive cyber operations. We're talking about how technology is reshaping the people side of... of spying right how is actually reshaping or affecting human intelligence operations and you're right gordon

That would be maybe a little bit above our pay grade on the rest is classified. So we have a very special guest with us who is going to be with us for these next two episodes to talk about the impact that technology is having. We're very lucky. to be accompanied on this journey by Glenn Chaffetz, who is a former CIA officer. He is a three-time chief of station, who was also...

the agency's very first chief of tradecraft and operational technology. Glenn, we don't hold it against him, but he previously served in the... State Department and the Arms Control and Disarmament Agency. He's taught or held research positions at a whole bunch of different universities, including the National Intelligence University, Stanford's Hoover Institution, the University of Georgia. Glenn has a PhD in foreign affairs from the University of Virginia, and he currently leads.

2430 Group, which is a nonprofit research firm that both educates and equips private businesses, universities, and NGOs to defend themselves against commercial espionage, attacks on infrastructure. and disinformation. So Glenn, welcome to The Rest is Classified. Thanks for being with us. I'm glad to be with you. Thank you very much for having me. So I guess the first question, which is going to be unrelated to the topic at hand, because I'm just curious, 2430.

of the 2430 group. What's the significance of that number? 2430 E Street, Washington, D.C., right across from the State Department, was the first home of, I believe, the OSS. the CIA when they were formed. The founders of our firm thought it would be a nice homage to the intelligence world.

OSS and Wild Bill Donovan. I'm not sure how much technical tradecraft he was involved in. He liked his gadgets though, didn't he? But Glenn, maybe you could tell us a little bit about how you ended up in the CIA because it sounds like you had quite an academic background and then how you end up

with this interesting role of the first chief of tradecraft? None of it was planned, obviously. I started out as an academic. I had a mentor in the field who said, If you're going to teach international politics and foreign policy decision making and foreign policy, you should have some experience in actually practicing that discipline. And I applied for.

and was accepted into a fellowship in the Arms Control and Disarmament Agency, which no longer exists. It was folded into the State Department more than a quarter century ago. And I became an arms control negotiator. And then when that agency was folded into the State Department, I decided to make the State Department my career. And I joined the State Department where I stayed for a number of years.

And then while I was at the State Department, I had a good friend in the agency whom David knows well, John. And John said, wouldn't you be happier in the CIA? And I said, I don't know. Would I be? And he talked fancy to me and he recruited me. And I applied to join the agency and started in the agency, spent the rest of my career there, retiring six years ago.

I'm glad to hear that John recruited you. I'm not sure how proud he is of that. No, no, no, no. Yeah, yeah, probably not. But we're going to be talking about the impact that technology is having on... the sort of human spy business. And I'm intrigued about the role that you held in this kind of first ever

chief of tradecraft at CIA. And I mean, I guess there's a question here, which is, why did that role not exist before? And why did the CIA feel they needed to create that role when you stepped into it? Well, it did exist. It was divided among several different units within the Directorate of Operations, because that's what we're talking about. And the leadership decided that given all the technological changes that were occurring rapidly, they needed one office.

that would coordinate all the different other offices and drive all the other different offices that were dealing with these issues. And so they created this position, which I think has evolved. significantly since my departure as well. So we're talking about human intelligence operations, which I guess sort of sounds simple, but just to start with a basic definition, which is...

What is the point of intelligence? What's the goal of that enterprise? I think it'd be useful to use an example so everybody knows about Operation Overlord, the invasion of Normandy, June 6, 1944. The Germans desperately wanted to know where and when the invasion would take place. They knew that there was going to be an invasion. They knew that from context. That was not a secret or a mystery that the Wehrmacht needed to acquire.

But they needed to know where and when. And the Allies needed to protect that information. And that really gets at the heart of what we're talking about. Intelligence is information of value. It confers value on the possessor. of the intelligence and losing control of that information of value diminishes the power and strength of the original possessor of the intelligence.

Those who have it want to keep it. Those who don't have it want to acquire it. And to protect it then makes that intelligence a secret. And I think it's important that people understand these definitions. and these concepts because it gets to how effective intelligence can be and how effective protecting secrets can be and the motivation people have for stealing secret intelligence.

Because I guess the point of an organisation like CIA or in Britain MI6 is to steal secrets. It's to gather those secrets from people. So in other words, to kind of approach people who have access to secrets and persuade them.

to pass on that kind of secret information that the government thinks might be useful so i guess just to kind of keep going with this conceptually to do that the spy services need to be able to operate clandestinely but in a world of increasing surveillance which is sometimes called ubiquitous technical surveillance now that sounds like quite a kind of fancy term i wonder if you could kind of

unpick what it means because I think it would help people to understand what's changed in the way that these spy services operate and why the kind of context is such a challenge. That's a great point. So ubiquitous technical surveillance, which was a term coined by a colleague of mine in the agency and really spread throughout all of society, sometimes called surveillance capitalism. is really the interweaving of modern technology into all aspects of our lives, often to degrees that we don't.

understand. And it has several components, sensors, cameras, phones, microphones, computing power, data, data storage and algorithms to make sense of that. information. And that information is used by the private sector and governments for various purposes. For governments, it's law enforcement, it's fraud detection, obviously intelligence collection.

For the private sector, it's some of the same things. But its main purpose is to sell us stuff. It's to know what we're doing so that they can put ads in front of us and that we will buy things. But it's also... to make our infrastructure more effective, knowing who's on the roads at what time and what kind of density can guide traffic control so that you have more effective.

infrastructure it can identify fraud detection is this credit card yours are you in this city are you in this zip code that kind of thing so it has a variety of purposes but it is the entire system that has been built up over the last say 25 years with the dawn of cheap data, cheap sensors, Google, Amazon, Facebook, Axiom, those kind of companies that for their business model track people.

It's worth saying that in some countries, it's more pervasive than others. And obviously, it's quite strong in Western countries with, as you put it, surveillance capitalism. But actually, perhaps the most surveilled state might be somewhere like China, where... You think about how many cameras there are and CCTV and the ability to do facial recognition, which they say is for social order and law enforcement.

People have to use apps and their phone to pay for pretty much anything and use any government service. All of that is kind of creating a web of information around an individual. And I guess the point is for spies is that means that it's harder to hide because of all the kind of data and digital exhaust created by life under this kind of surveillance. Well, precisely.

intelligence collectors and their sources in the pre-UTS days could have the kind of meetings that we're all familiar with in the back alley. at one in the morning the example i always like to point out is all the president's men where i think it was woodward had the meeting with uh his secret source later shown to be mark felt in a parking garage in Arlington, Virginia, who's very well dramatized in the movie. If you think about that meeting today, it would be much more difficult to do.

And the reason it would be more difficult is everybody's expected to have a cell phone. Everybody has this little spy with them all the time. And if you don't, that looks weird. And I remember having conversations when I was still in the agency with the commercial sector and saying, who is it that you find doesn't carry cell phones? I want to understand the pattern. And the person I was talking to looked at me like I had just grown a second head.

Everybody has cell phones. The only people who don't carry cell phones are, you know, drug dealers, infants. And spies. And intelligence officers. Right. So. Yikes, right? So you really stand out by trying to escape all the sensors and data that make up the UTS system. The other, I guess, concept...

from the standpoint of an intelligence officer and that relationship with an asset is you want that to be clandestine. And as you and I, Glenn, were talking and preparing this conversation, I think you gave a really interesting... definition of clandestinity, which I think you said is the sort of combination of privacy and anonymity. I wonder if you could

tease that one out as well. Yeah. A lot of people confuse these topics for very good reasons. They overlap. It is confusing. But privacy is essentially, you know who I am, right? You know the identity, but you don't know the activity. Anonymity is you know the activity, but you don't know the identity of the actor. Clandestinity is the marriage of both of those. So if you do a real good, successful operational act, nobody knows it took place.

There's no identity. There's no actor. There's no thief, in Gordon's words, of the secrets. There's no act. And because you're stealing information, there's nothing missing. So a perfect intelligence operation would be one in which anonymity is perfect and privacy is perfect and you have clandestinity. And that's what's required. And that is what is so challenging about today's UTS environment, because we are soaking in all of these technologies.

that make anonymity and privacy so difficult to achieve. Well, I think there we've set up the challenge for intelligence agencies and the problem in the modern world. Let's take a quick break and when we come back, we're going to dive deeper into how... this problem has really affected different parts of the human espionage business. See you after the break. This episode is brought to you by Atio, the CRM.

for the AI era. Now David, people think that spycraft is just car chases and secret codes but an awful lot of it is idling around waiting for the action. It's a bit like starting your own business. You think it's going to be as easy as creating and selling a product, but the reality is business owners spend far too long trying to get their CRM to fit a system not built for them.

Atio's AI-driven CRM enables you to take control of your platform to build something from the ground up that fits your needs. James Bond had Q's x-ray shades, an explosive watch, and a pen grenade. Business owners have Adio's real-time customer insights and platform that grows with them. All tools relevant for your mission to build a company.

from the ground up. Atio even has something called agent collaboration. Yes, but in this case, that means giving people the ability to let AI work seamlessly in the background for them. Try Atio for free at attio.com. This episode is brought to you by NordVPN.

a breach used to require a forced door or a lifted file now it begins the moment you join a dodgy public wi-fi network leave one device exposed and operators can map your online activity in moments nordvpn shuts that down one click encrypts your connection stopping public networks turning into blind spots and keeping your traffic secure wherever you log on nordvpn's threat protection pro feature blocks malicious links

phishing sites and even scans downloads for viruses. It's like having your own cyber bodyguard. And if you're abroad, you can shift your virtual location for the sites you rely on or check whether prices change by region before you buy. To get the best discount off your NordVPN plan, go to nordvpn.com forward slash rest is classified. Our link will also give you four extra months on the two-year plan.

There's no risk with Nord's 30-day money-back guarantee. The link is in the episode description box. New year, new gear. Thousands of fresh active styles are at Nordstrom Rack stores now. Save on top brands like Nike, Puma, and Free People. Starting at just $35. There's always something new. Plus, join the Nordiclub to shop new arrivals first, unlock exclusive discounts, and more. Great brands, great prices. That's why you rack.

Okay, welcome back, everybody. David, I guess it's time we start diving a bit deeper with Glenn into some of the specifics of what this all means for the business. And rather than do this kind of tech... first, I think it might be easier to actually just talk about the broader challenge by looking at how it's impacting some important parts of the human intelligence business. So sort of start with...

pieces of the trade that are being impacted and kind of talk about how the tech is reshaping them. And I think one of them, which is very important, finding the people who have the secrets we want. Typically, you'd call that sort of spotting and assessing potential targets of value, people who have secrets. And that obviously, you know, Gordon, I mean, we talked a little bit in our recent episodes on...

Chinese spies using LinkedIn, for example, to try to find people. But we've also done it in some of the more historical series as well. Yeah, I guess historically, Glenn, this would have been done by trying to meet people. by trying to talk to people. It's the classic thing we think of, isn't it? Of going to cocktail parties. You know, the diplomat at the cocktail party sizing up his KGB opposite number or similar.

trying to work out if he is KGB, trying to work out what kind of personality he is. There may be someone building a file and trying to work out what secrets he has. I always think of Oleg Gordievsky, you know, where they get a tip off from one person, from one defect to saying this guy's in.

interesting, then they build up a farm and then eventually someone I think approaches him on a badminton court, a kind of cold approach on a badminton court in Copenhagen of all places, to basically say, do you want to talk? I mean, that's the old school way, isn't it? And I guess that's what's got harder. It's harder and it's easier. And let me talk about how it's easier. So we just talked about all this data that's collected on each one of us every single day.

I think I read it's 2.5 sextillion bytes of data, which is an absolutely stunning number. Somebody, I think, described it as. Two Oxford English dictionaries on top of each other covering the entire planet Earth worth of information every single day about people. Right. So that's that's a lot of data. And if, for example, Gordon were interested in someone, he could use, avail himself of all of that data.

And you don't have to be anybody special to do that. This is not limited to intelligence services. This is what e-tailers and merchants and businesses do all the time to find customers and to detect fraud is they build a profile. And there's books written about this, how the modern surveillance economy determines when you buy, when you die, when you click.

who you know, what you care about. And so all that information can be mined. And we've heard about this data mining. And so in that sense, it's much, much easier to find out who would have the kind of information that... anybody would be interested in, including a government or an intelligence service. It's harder in the sense that if you wanted to go meet some specific person and talk to that person to feel out.

Whether, say, if it was Gordon and David, that you wanted to find out what David knew and how he was inclined. You're going to leave a record of that if you call him. You're going to leave a record of that if you meet him. You're going to leave a record of that if you see him at a cocktail party. And you don't want to do that because if he is valuable, you want that.

relationship to be clandestine, and you've already ruined that from the get-go. You can't put that toothpaste back in the tube. So you have to be exceptionally careful about making those associations. that at some point you would want to hide because they don't go away. And as I've told David in previous discussions, this technology, big data, has really changed previously our understanding.

and functions of time and place and what you can know about a person. In the old days, if you did an act like talking to somebody at a cocktail party. Okay, you had a conversation with someone at a cocktail party. As long as the people there didn't see you at the time and they didn't have an interest in that, that was fine. But the problem today is that meeting lives forever.

in cameras and microphones and other sensors. The fact that those two phones of you and that person were both at the same place at the same time lives forever in a way it wouldn't have done. That lives forever. In a way with Gordievsky meeting someone at a badminton court. that could have been done quickly and quietly. So yeah, it's a really interesting point, isn't it? Because we can find out much more about people now. So you could do the research bit.

pretty easily and i guess we all know as you said this is something we all do we all can kind of you can google people you can look up social media profiles so you can get quite a lot of understanding of someone You could even say spy on them without actually meeting them or having to kind of engage with them face to face. But as soon as you want to do that, engaging face to face or interacting with them or connecting with them, that's where it gets trickier. It's a devilish challenge.

It's doable, but it's very challenging. Because if you think about it, you're carrying around this device that's tracking you and you're moving in a sea of other devices that track you. various ring cameras and traffic cameras and business cameras and and other surveillance cameras and cctvs and microphones and people's personal cameras you're in this see of RF and data collection. And if you try to hide from it, you stand out. Yeah. And if you don't try to hide from it.

You're captured by it. And so you have to find that narrow place where you don't stand out and you're not captured by it or it's not you. So it's exceptionally difficult. It's doable, but it's difficult. One of the. areas of this entire kind of UTS environment that maybe we're sort of conceptually aware of, but don't really understand or see most of us day to day.

is this world of data brokers and commercially available information that's not top secret information in the files of the agency. And it's not open stuff that's on social media, but it's... information that if you have money, you can go out and acquire. I'm wondering, Glenn, if you could talk to us a little bit about that space and what's knowable about people if you have...

a few bucks and know the right data broker? It's a real appropriate question because we tend to think of secrets and open source information as the two. categories, but there's other categories and you just identified one. So there's open source information, which any of us can get for free. We go on our computers or our phones and we go to a browser and we go to Google.

or Bing or one of the LLMs. And we ask, you know, who's David McCloskey? But then there's this entire other category of commercially available information that you have to pay for. There's a guy named Mike Yeagley. who's done a lot of work on what data brokers have and how they make their money and what they can know. I spent a lot of time talking to him and learning from him, and it's just amazing.

what is collected. And there are these tiers of collection and the more money you have, the more information that you can get on people and organizations. And nobody really cares who you are. They just care that you can pay. And I think there's probably tens of thousands of these brokers around the world. I think the United States leads in this because it's the most unregulated. or loosely regulated data economy, much less so than, for example, the EU.

It's because we have more freedom here, Glenn, I think is what you're trying to say. I'm not going to comment on that, David. It might be more lobbyists from big tech, but the point is anybody can buy this.

data. It's not restricted in any way, and it's for sale. When we're talking about looking for people who have secrets that an intelligence agency might want, I mean, sometimes- People put that on LinkedIn, you know, I used to work for the CIA or I used to work for the NSA or I used to have security clearance, things like that. And also, I guess the other thing you're looking for is someone who had access to secrets or has access to secrets and someone who might have a kind of...

weakness or a reason why they might be willing to pass on those secrets, like they're in debt or they don't like their employer. And I guess that second category you can also probably get from some of that commercially sensitive information. If you can do a credit check on someone, you can access their credit or you can look at what they're trying to buy or where they're going or is their marriage in trouble. All those little telltale things which might actually...

um be relevant in this situation yeah well i think the most salient point that you made is that people share that information without recognizing that they're sharing it i mean this is one of the really interesting things about intelligence that people don't realize is that People don't recognize the value of their privacy, and so they undermine it constantly. And so they'll post on Facebook or InstaFace or Insta, I don't even know them all, Instagram. They'll post, you know, I hate my boss.

OK, good to know. All of a sudden they'll post a family picture and the spouse isn't there or a vacation that they took by themselves and all of these things. So they either say it directly. I hate my boss or someone who's clever can infer this. There's the famous case of, I think it was Target that sent directed advertising to the daughter in a family for her pregnancy.

Well, they inferred her pregnancy from her buying pattern, and she had not told her family that she was pregnant. I think this was a New York Times story many years ago. And so they either announce this information, I hate my boss, or it can be inferred from the rest of the data that's out there about them. I found a couple.

fascinating examples that are connected to that, Glenn. I mean, one of them was a former CIA officer. After they had left on LinkedIn, LinkedIn suggested to them that they should be... connected to someone who had been their asset when they were working at the agency because it had connected, I don't know what country it was in, but the algorithm had said, oh, you've got enough kind of overlapping.

connections, you should be connected. I mean, and on the point of like, even just locational stuff and what you can buy from data brokers. I mean, there was a researcher who had actually done a study for the defense department. to try to see what might a committed foreign adversary go out and buy on US service members. And so they set up a US-based organization and a Singapore-based organization, contacted US data brokers.

And they ended up buying individually identifiable contact, financial health, and a bunch of other data on thousands of active duty U.S. military service members. And they got it for about 12 cents. per service member. And they were able to geofence some of that stuff.

so that they could look at where a lot of these people were based, including some sensitive special forces operators. So these data brokers are just selling this stuff to Singapore, selling it to the states. It kind of doesn't matter. And it's really... That is a great start for a targeting package.

if you're a foreign intelligence service, and also if you're trying to show the right ads to these service members, right? So that overlap in sort of targeting effectiveness is, I mean, it's really... quite profound. And it's astounding what's available if you have some money. Yeah, this is the problem, is the data reveal connections that you don't recognize as being revealed. And to your point about US service members, this is...

a problem that all countries face. There was a story I think last week, China gave EVs to top Israeli military officers. I just thought, no, do not accept them. You know, because a car is like a phone except on steroids, right? And it collects all kinds of information about obviously where you go, but... When are you in the car? Who's in the car with you? What do you say? I mean, a car is a giant recording data device. So particularly the EVs, which have all these microphones.

and cameras and it doesn't go away so that was quite a trojan horse story so i guess so far we've talked about how data can allow you to understand someone

better and how they have so all of that makes it sound like it's actually easier to find people yes that part of the business yes arguably has got easier than the days of having to kind of build up gossip over years through kind of meetings and then maybe a cold approach but let's maybe focus next shall we David on the next stage where it's made it harder which is actually going to meet someone

for the first time, which I guess is about what's called David Cover, isn't it? It's about people taking on different identities and things like that. We talked about this a little bit, Gordon, when we did the series on Matrokin. How do you, maybe for the first time, how do you meet somebody and how do you, I guess, frame your employer, your affiliation, your nationality, your name?

That piece of it, I think, as we'll talk about, has gotten a lot harder because in the Matrokin case, it was relatively, it seems straightforward. When you look back at these cases from the Cold War and even into the 90s, I guess. All these case officers, all these kind of handlers, they just basically had a stack of false passports. It was as simple as that. You had a false passport with a different name in your safe.

And when you're kind of going on a particular mission, you go, you know, today I'll be James, tomorrow I'll be Robert, pick up the false passport. And that was kind of all you needed. Yes, you've got to memorize your backstory and, you know, where you were born and things like that if someone's asking you. But that...

that was it wasn't it you know for a lot of people you didn't need to do much more to kind of mask who you were and that's certainly what the kind of mi6 team who went out to meet my truck and did they just

picked up one of their false identities. But then I remember someone from MI6 saying that in the 2000s, they suddenly realized that that was getting harder because the ability to maintain your cover when you hit a border, they realized as soon as you had Google and social media in the 2000s, it was getting really difficult because they did a test and they said,

How long would one of those old-fashioned types of cover, just a passport, sustain you against a border guard asking questions and with access to Google and social media? And the answer was less than a minute. before they realised that there wasn't a backstory, it didn't match. You just couldn't do what you could do in the past. So I guess it was the 2000s when people started to realise you just couldn't do this anymore in the same way, travel as an intelligence officer.

Yeah, thank you, Google. I think it really started with Google and AdWords. And again, Google wasn't trying to do this. Google wasn't trying to destroy anonymity and privacy. But AdWords. Which is their advertising business. Their advertising business, which generates probably tens of millions of dollars a day. Revenue, if not profit. Started essentially this dynamic.

And then you reach a point in which storage becomes so inexpensive that it's cheaper to keep most information than it is to delete it. I think that happens somewhere. around 2010. And then of course, you had the crossover point in which most uses of computation moved over from the desktop or laptop to the telephone. And once it became mobile, well, now you associate identity with location. And that becomes very, very challenging.

And I mentioned this colleague of mine, Mike Yagley, would do these presentations where he would show people their pattern. He would buy it from an appropriate data broker. He would show somebody their pattern and they would realize it was actually fairly simple. People do the same thing every day. We're exceptionally habit driven. We go home, we go to work.

We pick our kids up from school. We might go play tennis or go to the gym or something like that. It's pretty simple. Most of us are shockingly boring. And so when we do something that's out of that pattern, that's... noteworthy. I think all of us can think of times where you get an alert from your credit card that says, oh, I see that you're in Penn Station, New York. That's not where you live. Is this you? If it isn't, please contact this number. If it is, just ignore it.

Right. That's frightening to me. That's a private company that does that. And that keeps that information forever. And so really, I think this is what you're referring to, this tracking that's part of our normal economic existence. affects everybody, including intelligence collectors. And you bring up the fraud point. It's a good one because I guess this same algorithm that is detecting some anomaly in...

your location or your payment history, it could be used to detect potentially the operational act, right? Because that's by definition going to be a, well. In the past, it would have been an anomaly. I guess it would have been something that was potentially out of pattern. And again, that fraud detection, I mean, that's like Amex has developed that, right? So that's not being developed by the MSS or the CIA. That's a private company.

got it. I'm curious on the, I mean, one of the pieces of, I guess, this UTS environment we haven't talked about in detail is biometrics. So the linkage of sort of your- your retina, your fingerprint, whatever your face with you. Talk a little bit about how that is maybe impacting clandestinity or the work of human intelligence today. You have these sensors which take...

photos of you from various angles and then process that data about the distances and angles of the various features of your face. And they construct a digital map of your face. And it's your face and only your face and nobody else's face. And it's gotten quite good and it's going to get better. And now it can recognize you when you've got a surgical mask on. Got a lot better during COVID for that reason. So if you try to disguise yourself.

That's a bit of a challenge. So the most obvious one, I think, is facial recognition combined with the statistical automated AI machine learning capabilities and algorithms. that make each one of us uniquely detectable based on our face. Then you have iris scans, all of which are becoming more pervasive. and cheaper, of course, fingerprints. And people open their phones with their thumbs and they open their phones with their photographs. And of course, this is stored and shared and can be used.

Again, for law enforcement purposes, for identification, for sales purposes, various hotels and retail establishments recognize customers when they walk in the lobby because of facial recognition. I find that unacceptably creepy. But these establishments rely on this and some people like it. Oh, hello, Mr. McCloskey. Welcome to.

Acme hotels. Sorry, if there really is an Acme hotel, I don't mean to disparage you. We'll bleep it out. We'll bleep it out. Yeah. Because I remember hearing that one of the first challenges for the intelligence services was Irish recognition. Yeah.

Middle Eastern airports introduced the idea you were going to get your iris scanned on arrival at the airport and they suddenly thought hang on a sec I can go if I go under that false passport I'd used before and my iris is scanned when I if I turn up here next time on holiday with my family you know and have my iris scanned and it says this is the same iris as a different name they're gonna go

spy and arrest you. So that was, I guess, an early example of how that was a worry. Disguises in the old days would be like a wig, all those kind of things. I mean, in the movies, you'd think they're a kind of... maybe this is getting into detail you can't get into glenn but in the movies if i'm watching mission impossible or something like that there's kind of fake fingers fake

irises and things like that you can do to fool them. I mean, does disguise still work in the world of biometrics and where they can see how you walk and things like that? I don't know. I think it would be exceptionally challenging. I mean, obviously, if I put on a mask of David's face. Lucky you. You know, I would obviously be much more successful.

But if I put on a mask of David's face and I wear a perfect mask of David's face, sure. I don't know if such a thing exists outside of movies. It's very difficult to... disguise yourself i guess in theory you could uh burn off your fingerprints and but this is all it's the mathematics of the distance of different parts of your face from other parts of your face

which is highly invariant, right? And I think also if you showed up at a border with a heavy mask, you might get some questions. I wouldn't base my tradecraft on the Mission Impossible movies.

No, I seem to remember there was a problem with laughing if you had some of these masks, David, that there was some history where, you know, the masks were fine. And as soon as you laughed, you had a problem. So yeah, they definitely had their limits in the Cold War. Yeah, well, I mean, it also seems like... From the standpoint of the disguise, I mean, even if you had one that was quite good, your ability to wear that for any long period of time, I think would be pretty...

pretty diminished. I mean, it just seems very technically challenging. I guess, you know, Glenn, the other piece of this, we talked about, you know, facial recognition or gait recognition or like person recognition. I mean, there was a story, I think maybe a couple of years ago about how... The Russians, surprise, surprise, had become quite adept at using the sort of camera networks around Moscow to find draft dodgers, you know, people who were.

called up to Ukraine and had decided not to go and were still for some reason hanging around Moscow and were able to make a bunch of arrests around that. I'm curious about some of the back end pieces of this because we think we go out and we walk around any major metro area. It could be in the States. It could be in London. It could be Moscow. And there's cameras everywhere. Those cameras are not always...

centralized especially in the states it could be a lot of private companies in london i can tell you they are everywhere though right they're everywhere they seem everywhere but there's a back end to this which is the analytics to do something with that information right I'm curious if you could talk a little bit about that sort of back end. It's not very sexy, but you think about someone's got to take all this data, which in its kind of...

you know, what's collected is probably pretty unstructured and not exactly useful from an intelligence standpoint. But then the backend, you know, maybe AI powered bit, maybe not to make sense of it is really. kind of the beating heart of it. Maybe talk a little bit about that piece of it. Yeah, it's a really good point. The wishful thinking that I get from people when I talk about this is it goes something like this.

could ever process all that information. They can take all the pictures, but nobody's going to look at all those pictures and, and nobody's going to. Find me. I think relying on the incompetence of the adversary is not a particularly successful strategy for achieving your goals. There's all kinds of experiments done with this.

probably rigged to make them look more successful. But in general, the issue is time and automation. And so, for example, if you talk about China, which is, I think, the most heavily... camera it up large country in the world. That's a word I've really come to enjoy, camera it up. I think there's like a million surveillance cameras in Beijing alone. It's probably an understatement at this point. Yeah.

You look at London, which is much smaller than Beijing, but London, I think, has tens of thousands of cameras. And Beijing has millions. Yeah. And Shanghai has millions. And any large city in... China has millions. And the authorities have all the time in the world and all the computational power in the world and all the algorithms that they can avail themselves of to look at these photographs, both video and still.

private residences and businesses have to share their camera feeds with authorities. So my advice to people is if you see the camera, assume it works. Assume someone's going to see what's on that camera. Now, it might not be today. It might not be tomorrow. It might not be this year. But for example, if you're committing a crime or if you're doing espionage. an asset caught a year from now is still caught, right? And so the conversation that intelligence officers have to have now

concerns, am I safe for all time? And it's not a question that's easily answered. Back in the day before all of this technology existed, an intelligence officer could do an operation, come back home. Know that he or she got home safely. Find out that the asset later was safe. And that's that. But now you have to wonder for days and weeks and months and years.

If something is going to trigger an investigation that leads a service to go back through that video or still photography. And like you said earlier, I think it was Gordon, connect two people who weren't connected. There could be a newspaper story saying, hey, this person worked. for the Russian intelligence service. Oh, I thought he was a businessman. That's interesting to me.

I'll go investigate and whether he met with anybody from our government. Yeah. I mean, we've definitely seen examples here in the UK where they've used that kind of CCTV. I mean, the Salisbury poisoning 2018, you know, they were able to identify using CCTV from the train station. Your point about... about underestimating CCTV and things like that at your peril. I remember the Israelis, Mossad, normally thought it was one of the most capable intelligence services.

2010, they carried out this hit in Dubai against Mabu, I think a Hamas official, in his hotel. And they seem to have just not realised how much CCTV there was in the hotel. And there was just all this amazing CCTV of people going into a kind of bathroom, coming out in a different set of clothes. I think a tennis uniform at one point, you know, they clearly underestimated.

by intelligence, the UAE intelligence service's ability to track them at their peril because it basically burnt a lot of identities I think they were using. So yeah, I think people have learned often, haven't they, from some of those mistakes. So I wonder if we stop there for this time. Because I think we've set up some of the problems around these issues of technical surveillance and data. And next time we dive even deeper into some of the kind of...

ins and outs of running agents and human espionage in the digital age. And of course, if you don't want to wait for that second part... you don't have to go to the rest is classified.com join the declassified club get early access to that episode and to a whole bunch of other goodies as well but we'll see you next time see you next time

The holidays mean more travel, more shopping, more time online, and more personal info in more places that could expose you more to identity theft. But LifeLock monitors millions of data points per second. If your identity is stolen, our US-based restoration specialists will fix it, guaranteed, or your money back. Don't face drained accounts, fraudulent loans, or financial losses alone. Get more holiday fun and less holiday worry with LifeLock.

Save up to 40% your first year. Visit lifelock.com slash podcast. Terms apply. Hello, I'm Professor Hannah Fry. And I'm Michael Stevens, creator of Vsauce. We thought we would join you for a moment completely uninvited. We are not going to stay too long.

I mean, unless you want us to, of course. We're here to tell you about our brand new show. The rest is science. Every episode is going to start with something that feels initially familiar. And then we're going to unpick it and tear it apart until you no longer recognize it at all. You know how banana flavour doesn't taste like bananas? Yeah, what is that about? So it is supposed to taste like an old species of banana that was wiped out in a banana-pocalypse.

And now you will only find it in botanical collections in the gardens of billionaires. Wow. Banana candy is actually the ghost of a long extinct banana. So if you like scratching the surface, thinking a little bit deeper or weirder, yes, definitely that too, you can join Michael and I every Tuesday and Thursday, wherever you get your podcasts.