The following are the outputs of the captioning taken during an IGF intervention. Although it is largely accurate, in some cases it may be incomplete or inaccurate due to inaudible passages or transcription errors. It is posted as an aid, but should not be treated as an authoritative record.
***
>> MODERATOR: I'm here to talk about a project that I was early in its life involved with, and it's very close to my heart. It's the Nym Project. Before I give the floor to the speakers, I want to make a reflection about this very important project first. It's a project that was born with public funds initially. It was a project that was thought by academics and activists, you know, the typical approaches of creating technology. And it was a project that was born from the very need and after the shock of the Snowden revelations that uncover a broken infrastructure where privacy was not viable without making lots of patches without sacrificing a lot of time and innovation. Today it is my great pleasure to invite to the floor two great speakers. One is Andres Arauz who is going to speak more to the problem the technology is going to solve. And then Harry Halpin, the CEO of Nym technology whose is going to explain how this technology that is guaranteeing privacy by design works. The program is yours.
>> ANDRES ARAUZ: Thank you Renata, thank you, Harry for making that possible and hi to everyone around the world. So I'm going to make very brief comments about why it's important from a perspective of a Global South country that wants to build technological system and wants to have an information system that protects both its citizens in terms of their personal data, their rights and rights to privacy and so forth. Also entire government's strategies in order to gain more sovereignly
we saw that when the Snowden regulations occurred. The NSA had spied on the Brazilian president, German president, Angela Merkel, and many many other world leaders, business leaders, state owned enterprises and so on using that kind of technology. Of course that puts any strategy to become a truly sovereign nation at risk. This is why we need technology that not just, you know, fits into a pattern of new regulation or new laws and say we have a new privacy law, we have a new, you know, political statement from politicians that are saying that they won't spy on foreign countries or on their citizens. We need technology that embeds the human rights to privacy, where the standard itself or the hardware and software that are involved actually protects these human rights and protects this right to development of countries.
This is why I think this is important, this is also why I am actively supporting Nym, and now we can hear from Harry on how this actually works.
>> HARRY HALPIN: Thank you so much, that was a great introduction. I'll give a short ‑‑ can we turn on the slides really quickly. I'll just give a short introduction. So, you know, our goal is to defend against what's called a global network adversary. What is a global network adversary? It's imagine someone who has like a God's eye view of the network. Someone that can watch every packet coming from your computer, going to any other computer anywhere in the world. Next.
And a lot of people don't understand these adversaries. People would think that Tor and signal and a lot of other projects defend against these adversaries. In reality why they provide some kind of protection they don't protect from these adversaries. The NSA could read it coming in and out of the servers. It's encrypted they can't read it, but they can see who you're talking to and when. Same with Tor. We'll discuss that more in a second.
Next no existing solution except we think Nym defends against the NSA. It's not just the NSA, company like Microsoft, countries like Russia and China and cyber criminals are gaining these adversaries. Your telephone company can cooperate with your government, even if you live in a country that's not high tech and they can do these attacks. VNPs and Tors are not magical solution. Tor is probably as good as you're going to get for web browser. For things like instant messaging or file transferring, asynchronous messaging traffic we have a better solution. Next. So the solution is a mixnet. The mixnet basically does what you think it does. It takes the packets and mixes them up, like shuffling a deck of cards. Each packet you send over the internet, it encrypts the cards, makes them all look alike and shuffles them up. There's other aspects I'm not going to talk about. There's a token that pays a decentralized network for running these and there's a credentials system which allows people to kind of authenticate themselves without identifying themselves. To prove for example they're a valid user. Next.
That's useful for DDS attacks. So how does a mixnet differ from a VPN? Similar to Tor it's a decentralized vaguely peer to peer network where there's multiple hops. Each packet goes through at least three hops. It's mixed three times, so that's kind of ‑‑ if you treat every packet equally, everyone is equally anonymous. When there's not enough people using the network we add cover traffic. Cover traffic adds fake traffic. Let's say if only five people are using the network you can appear to be 50 people with this fake traffic at a given moment. Again, the packets are mixed and most importantly the network horizontally scales. This means that if more people want to use the network rather than slow down like a VPN would typically slow down, you can simply instantly add a new node due to the kind of token based reward system. Next.
Next. There we go. This is the comparison. This is probably the best slide in the whole presentation to understand what's going on with Nym. So you can see I'm a user, I talk to Google or a web service, right. Okay, so the traffic there, you can see it's different colored dots, different sizes. That means there's kind of a different volume and timing information. Certain packets may encode more data, maybe it's calming out in a bursting manner. This data whenever you use the internet is kind of like a fingerprint that you can use to identify someone. It goes into your VPN and comes out. Maybe the website won't know who you are, but the VPN knows everything you're doing. In order to prevent this kind of attack, Tor and other decentralized VPNs, but Tor is the only one to my knowledge that works well, basically have multiple hops. In order for them to figure out who you are, they have to deanonymize and compromise not just one VPN by sending them for example a letter saying please hand us this human rights' data, they'd have to talk to three different people if they are spread out and change every ten minutes it's harder. That's why Tor is useful. A mixnet is similar to Tor, also has three hops but you can see the hops are spread out in a different way and they're fully connected.
So what this means is that the packets come in, they're mixed up, fake packets are added, and you can see they come out and the fingerprint is kind of gone. All the packets when they're coming out look the same size and they're coming out using the same kind of what's called a pason distribution. Basically it helps anonymize the network so the enemy ‑‑ you can see if I'm watching this and this and this and this I can see they're the same. If I see this and I see this, I can't kind of identify who this is. Because it might be for example 12 people or 200 or 2 million using these kinds of packet fingerprints. Next.
If you want to know how this works on a deep dive level the packets go to a local SOCKS client, lets you send stuff into the mixnet. It comes in and comes out. If there's not enough traffic, not enough mixed nodes we add more stuff here. You can see we kind of convert your packets to a special format called a sphinx packet before sending it out. This works too. If you want to make money providing privacy, not so much. Just like you can run a Tor relay or your own VPN, particularly I know a lot of people in China for example run shadow socks. I personally run a Tor relay. I recommend everyone run a Tor relay. Run a mixnet. Join the mixnet and you'll start getting rewards for doing this. Code is all open source, free software. On git hub. There's a telegram chat. So you install it on your computer and then you're helping other people be private. Next.
And also if you just want to use the software, it's currently again still very much in testing mode but it does work. You can download the software, it's called Nym connect. It tries to make Nym as easy to use as a VPN. That's the software there. And what you can see is that this software is very simple. You download it, it works on Mac, Linux, windows. Doesn't work on mobile yet. You get a button, it's yellow when you're not connected. You choose what software you want to anonymize. Currently we work in telegram which a lot of people in Russia and Turkiye use. And Ukraine of course. We also have some other problems like Keybase and Bitcoin and they hit that big button and it turns green and you know it's working. Next.
And if you're really into it you can do it all yourself without downloading our software. But that's a little bit more advanced. Next.
And you know, I would want to say we should support Julian Assange. I mentioned this yesterday. He was one of the people we discussed in mixnet. In the early stages he was supportive. There were few other people that were supportive except weirdly the European commission. Our early funding came from the European Commission. Julian Assange said you should pursue this other than being a professor. I took career advice from Julian, maybe not a great idea. If you have any questions that's our Telegram channel. All questions can be answered there. That's our website, there's links to download the software. And we have the documentation of your developer, linked to the website as well. So that's it. If there's any questions, we're happy to answer them.
Any questions? Maybe ask Iness if there's something, I'll check. If not we don't want to hold you guys up.
>> REMOTE MODERATOR: Is there any questions from the audience? I would also like to remember (?) in prison in Egypt and all the activists we somehow forget to mention in events like this. That they are in jail for just being activists. And projects like this would be really important for people, especially in the Global South, but really everyone. So I would like ‑‑ maybe I can start with a first question, Harry or Andres. What is the connection between what we think of the internet as sending basically e‑mails or messages or anything really in a private way and the financial part of using privacy enhancing technologies.
>> HARRY HALPIN: This is what we'll cover tomorrow. I think it's called the data money presentation. I don't remember the time. Effectively you need this technology not just for e‑mails and chat but also for money transfer. Otherwise visa or the swift or the U.S. government knows exactly who you're sending money to. So there's a very funny statement that Julian Assange said once, Putin probably would like to leave visa at some point because the U.S. government knows every time he buys a Coca Cola.
>> MODERATOR: Tomorrow we will have surveillance of money discussion. It would be at 4:15 Ethiopian time. Three hours before in the UTC. And we will be discussing the surveillance of financial flows as well. And it's important to remember that, you know, credit card networks, but also commission payment systems like Swift and so on do harvest this data. It's stored and then transferred to hegemonic power players, not to the average citizen or to developing countries. Right.
So there are several issues in here, and of course this would give much more freedom to people to move their money around. Now you mentioned Assange, one of the first few cases where we had this surveillance acting upon activists was when the credit card networks decided to unilaterally suspend all donations that were going to WikiLeaks. Much more recently you had people in Canada protests against certain COVID restrictions and the government applying financial surveillance started to freeze all of their bank accounts.
So this is an issue that's definitely not far away from reality, it's a day‑to‑day thing we're living, and we'll be discussing all of that tomorrow.
>> HARRY HALPIN: Are there any other questions? Otherwise we hope to see you tomorrow. The day of money where you'll learn from Andres exactly how your financial transactions are being surveilled and what we can do about it.
>> MODERATOR: Thank you.
>> REMOTE MODERATOR: Thank you.