A Conversation with Prof. Diogo Barradas

Ultimately, Diogo feels that while there will never be a concrete answer to these questions, tools to circumvent censorship will be developed regardless, with legislation having to keep pace with ethical monitoring of digital communication and technology.

The process of stress testing the security of privacy-enhancing technologies, like anti-censorship systems, is a significant part of Prof. Barradas’ work, which again raises interesting ethical and legal discussions. Put briefly, stress testing involves aggressively trying to compromise a given set of privacy-enhancing tools on a network infrastructure, in order to determine its weaknesses (e.g., whether they can be detected by a nation-state censor). Diogo explains how this is crucial for improving said defences; if you don’t test something, you do not know how/when it is likely to fail, therefore you cannot improve it. The core idea here is that he attempts to stress test the security of privacy-enhancing technologies (such as anonymity networks and anti-censorship tools) in the same way a network adversary (or a censor) would do.

 The issues arise when we focus on who does this testing and what they do with the vulnerabilities they uncover; one can report the problems so that they are solved, one can also exploit them for gains at the personal level, or at an ‘organizational/state’ level. For example, a nation-state censor would not break an anti-censorship tool for personal gain, but potentially for enforcing an agenda or stifling an opposing viewpoint.

Sharing these methods to circumvent surveillance and censorship can promote free speech just as easily as they can support criminal activity. Ultimately, he posits that despite the dangers and potential misuse, stress testing (not unlike encryption, as mentioned earlier) must still be employed and that there is little, if anything, that can be done to fully eliminate unscrupulous use of such methodology by bad actors. Hence, it must be prosecuted and combatted to the best of our abilities by developing stronger defences and responses.

In relation to the intersection of legislation and technology, Barradas discusses another focal point of his curiosity, the field of digital forensics. This is a branch of forensic science encompassing the recovery, investigation, examination, and analysis of material found in digital devices, often for the purposes of investigating crime. As cybercrime has become a staggeringly costly branch of criminal activity globally, being able to investigate and prosecute cybercriminals is a salient area of research, wherein digital forensics plays a key role.   

Diogo explains that our legal system moves significantly slower than the pace of technology; hence, creating laws to tackle cybercrime, including the legal frameworks surrounding digital forensic investigation, often lag far behind where they need to be. He posits the example of how judges and juries must be presented with digital evidence in a manner that is admissible and properly vetted, noting that there is a process that must be established and followed for ensuring that pieces of evidence are not tampered with, in line with the same concepts of chain of custody that you would have with non-digital evidence.  

Diogo has consulted with legal expert Maura Grossman, also a CPI member, on the subtle intricacies of how digital forensics activities can be conducted in a manner that will address such concerns. He illustrates such a point by outlining how obtaining a warrant to search a laptop must specify just cause, as well as specific components being searched (hard drive, live memory, network connections, etc.,). Then, a ‘hash’ must be created, which is a summarization of collected information that will survive tampering; so, if someone tampers with that evidence, you can detect that that piece of data was tampered with during the chain of custody.

Another legal principle in play that he expands upon is that of accidental disclosure, wherein evidence of a crime is found, but it is not related to the investigation or warrant being served. Diogo offers the example of a forensics team investigating a malware breach at a company, wherein the examination of a hard drive reveals child pornography images; as this was accidental discovery and not the focus of the search, this would typically require a second warrant focused on a more comprehensive and explicit search of this kind of images in the target computer, as in this example.  

Discussing his role as a professor, Diogo underlines the importance of creating and facilitating courses that directly engage with his stated interests in order to create similar enthusiasm and awareness in his students. With courses such as CS 458 / 658 — Computer Security and Privacy and CS858 - Internet Censorship and Surveillance, Prof. Barradas stresses the importance of said topics while pairing them with a strong focus on the ethical responsibilities for those who will gain the knowledge to perform high-level activities in these areas.

He goes on to say that interdisciplinarity is crucial for UWaterloo students, maintaining that academia must provide a broad knowledge base for students to be effective in the world; again noting the intersections of digital, legal, social, and ethical concerns in every topic we covered during this lively and informative discussion.

In closing, it bears repeating that the curiosity of Diogo Barradas may have endangered the cat at several points, but he has used that curiosity to relentlessly pursue his research in multiple areas that benefit the world in myriad ways, (cats included).