(bright music) - A man checks his smartwatch.

- Our modern, digital lives offer limitless convenience, community, and easy to access everything.

- [Speaker] The internet opens unbelievable opportunities.

- [Host] But there's a trade-off.

Your personal data.

- [Speaker] Pretty much everything you do on the web is being tracked and logged.

- Who you are, what you're doing, and where you're going.

- This is the mothership.

Can you show me what I've inadvertently given up?

And that personal data is worth a fortune.

- People expect it to grow to $400 billion.

- To completely avoid data collection requires you to go live in a cave.

- [Host] Thankfully, there are tools to help maintain your privacy and security online.

- Let's create some strong and unique passwords.

- Everything has privacy settings.

We can dial to whatever level we feel comfortable.

- [Host] And some coders are rewriting the rules of the web.

- The decentralized web is our antidote to the web as we now think of it.

- New technologies can proliferate without centralized control.

- This is about technological self-determination.

- [Host] Secrets in your Data right now on "NOVA."

(triumphant upbeat music) (triumphant upbeat music) (phone camera clicking) PATEL: Our world runs on data.

When you're shopping online, streaming your favorite shows... (mouse clicking) posting family pics-- that's all your personal data leaving your device.

(on phone): What's up, everyone?

I'm about to head to the hospital for a night shift... (voiceover): I'm Alok Patel, a pediatrician, medical journalist, and all-around social media enthusiast.

(on phone): Just got here at the children's hospital... (voiceover): I kinda love our connected lives, and I haven't been shy at all about sharing mine pretty publicly.

(on phone): 30 million children... (voiceover): And I know that sharing personal data can have major upsides.

The media's reported on some of the most dramatic examples.

NARRATOR (archival): ...is conducting several studies to see how far wearables can go in detecting disease.

A California man, rescued yesterday after going missing credits a social media post for helping save his life.

Six out of ten people with Alzheimer's or dementia will wander away from home, and that's where this little box comes in.

PATEL: There's no doubt, our data is out there, but did you ever wonder where it goes and how it's used?

I do.

I want to know: what are the benefits of sharing and the risks?

And what can we do to make our connected world safer and just generally better for everyone?

First, the basics.

I want to know: how much personal data have I been sharing?

Meet Hayley Tsukayama, tech journalist and data privacy advocate.

(chuckles) PATEL: You must be Hayley.

Hi, nice to meet you.

What is going on?

(voiceover): Okay, hold on, wasn't expecting this.

She's already got my whole life up on the screen.

So this is a data report gathered about you from social media posts, from the images of you that may be on the internet, from publicly available information.

This is like a family business.

That's my dad's cell phone number.

Why is this available?

(groaning): Oh, this is my address!

This is just available?

Just available online.

Okay, you guys are going to blur all this, right?

Please?

There's-- oh, okay, cool, there's my cell phone number.

Oh, this is concerning.

As a medical doctor, we all have license numbers and issue dates and expiration dates.

(chuckling): And it's literally right here.

This is so weird, these are the names of my neighbors from my childhood home.

(whispering): Why do you have this information?

Like, I haven't seen these names in... years.

(voiceover): Not gonna lie, I expected some of my data to be out there, but this is... this is just creepy.

How is there a report about who my neighbors were in the '80s?

LEVY: You can be assured that pretty much everything you do on the web and with a browser is being tracked and logged.

Where you go, what you look at, what apps you use.

SAFIYA NOBLE: Modern life has been arranged so that every aspect of what we do and how we live can be captured.

MEREDITH WHITTAKER: They pick up our faces as we walk down the street.

They track our keystrokes while we're at work on behalf of our employer.

(keys clacking) GALPERIN: And ad networks use a bunch of creepy and nefarious ways of figuring out who you are, what you're doing, and where you're going.

PATEL: What happened to the web I grew up with?

♪ ♪ I came of age when the internet was a fun and weird party, and everyone was invited.

Remember GeoCities, AOL Instant Messenger, or the dancing "ooga chacka, ooga chacka" baby?

♪ ♪ Today, it's clear that innocence is gone.

Is the party over?

To understand the present, I want a refresher on the past.

(machinery whirring) So I'm visiting the Computer History Museum in Silicon Valley.

(video game music, Patel chuckling) MARC WEBER: Okay, I'm headed straight for the sun... PATEL: I'm meeting computer historian Marc Weber.

What a maneuver!

There's a straight line of bullets coming right at you-- (exploding sound effect, Patel groans) (voiceover): ...Who just wasted me in the cosmic battlefield of "Space War," one of the first video games.

(laughing) This is actually really fun.

♪ ♪ This is cool.

ICBM computer from a nuclear missile.

Woah.

Human-computer interaction.

PATEL: Now, this looks fascinating.

I can't tell if this is like, this universal clock apparatus, or what's happening here?

This is the first punch card machine.

And this was an invention to make the U.S. census faster.

PATEL (voiceover): It's kind of wild, but the dawn of automated personal data collection looks like this-- census info poked into humble little punch cards.

Marc, can you explain punch cards to me?

Because when I think punch cards, I'm thinking lottery tickets, or "buy nine cups of coffee, and your tenth is free."

Well, it was the first way to record machine-readable data.

PATEL: Okay, let's make sense of the census.

This kind of data collection has been going on for centuries.

But starting in 1890, data was recorded in a pattern of holes "punched" into a census card.

So the cards were used to collect census data.

What exact questions were on there?

So things like age, gender, number of children.

PATEL: When a card passes through the machine, the holes allow pins to make electrical connections through the card.

A counter keeps a running tally in each census category as more cards pass through.

Census data is how the government allocates resources for schools and hospitals; draws the lines for districts; and decides how many representatives each state will send to congress.

It's a reminder of the value of collecting data, but it's a far cry from having my every move tracked on the internet.

To help connect the dots, Marc shows me the next surprising step in the evolution of data collection.

♪ ♪ I look at this and I'm almost like, "Oh, this looks like a modern office building to me."

WEBER: Exactly.

Each one of those is one of these giant terminals here.

(static hissing) PATEL: During the Cold War, IBM figured out how to hook up computers from all across the country to monitor U.S. airspace in real-time.

(rocket blasting off) So, this is a terminal from SAGE.

(beeping, static) PATEL: It was the first real-time networked data system.

Real-time is just that: instantaneous.

And "networked" means connected.

Computers from all across the country were hooked up to each other, so they could share data in real time, Sort of like the internet.

WEBER: The whole point was to track incoming Soviet bombers, and they built, arguably, the first computer network in the world.

PATEL: IBM soon realized that their aircraft-tracking computers could be used commercially.

♪ ♪ So In 1960, along came SABRE.

(beeping, static) A real-time networked data system that shared personal data.

WEBER: The story goes that the head of American Airlines met with IBM, and they decided to do a partnership, the key idea being real time.

They could look at your age, your name, financial information, what flights you'd been on before, your dietary preferences for your meal, all of this right then in real time.

PATEL: We went from tracking bombs to tracking butts on planes.

WEBER: Exactly.

PATEL (voiceover): Between "Pong," punch cards, and planes... Whoa, whoa, whoa!

PATEL (voiceover): I could see how data started connecting the world-- the military to our airspace and companies to their customers.

But what if those customers all over the world were linked up to each other?

What would we even call that?

Oh yeah, the World Wide Web.

PRESENTER: The World Wide Web is a part of our lives and getting bigger every day.

But what about the man who dreamt it all up?

PATEL: News reports opened our eyes to this innovation and its creator, Tim Berners-Lee.

PRESENTER: He simply wanted to give it away for the benefit of others.

TIM BERNERS-LEE: When the web started, anybody could make a website.

You could make your own style, your own poems, your own blogs, and you could link to other people.

The feeling and the sense was of tremendous empowerment.

(modem dialing up) NOBLE: Some of us remember the internet when it was managed and curated by people.

Where it was, you know, bulletin board systems and chat rooms.

♪ ♪ PATEL: In the late '90s, small start-ups were maturing into big tech companies-- with lots of users and user data.

KAHLE: As the web grew, we ended up with a very few companies going and doing all of the hosting.

It wasn't your actual personal computer doing it.

NOBLE: The large platforms that have emerged are dependent upon user-generated content and user engagement.

The modern internet is a wholly commercial kind of internet.

PATEL: And as web traffic started to flow more and more through just a few companies, they began to realize the value of all this personal data piling up on their servers.

ALEKSANDRA KOROLOVA: Google started to understand the power of individual's data.

They have information about not just how the websites are interconnected, but also information about the individuals.

HILL: The big technology companies.

They're looking at where you are, They're wanting to know what your gender is, what your age is, you know, how much you have to spend, what your political beliefs are.

They have a lot of power to determine what our privacy is.

RASKAR: That's trillions of dollars of economic value that's out there, and there's a constant struggle between who owns the data.

We create the data, but somebody else monetizes it.

PATEL: As big tech was maturing, early data collection on websites was pretty limited.

So what happened to supercharge it?

To create the vast tracking infrastructure that allowed Hayley to find out so much about me?

It turns out things really got going when someone invented...

Cookies?

A cookie is not actually a tasty snack.

When you go to a website, the website sends a small file to your browser.

(keys clacking) PATEL: That small file allows the websites to collect information about your visit, and update it every time you come back.

You might have heard of cookies because a lot of websites pop up with messages prompting you to accept theirs.

But what happens after you hit "accept"?

GALPERIN: It then uses cookies to track who you are and what you're doing, including in many cases, all of the other websites that you go to.

RUMMAN CHOWDHURY: Cookies have the cutest name, but they're actually a really important piece of information about you.

Every time you click on a menu, every time you look at an item or put it in your cart, every time you want to buy something and click out of the website and come back in.

A cookie is what's enabling you to do that.

It's a piece of tracking information.

You can impute data and information about you from the seemingly innocent behavior online that's tracked via cookies.

Do you have certain lifestyle conditions?

What age are you?

What gender or race are you?

Do you have children?

PATEL: Okay, so I'm starting to get that these tech companies use things like cookies to keep track of what sites I'm on, what I'm shopping for, and what I'm watching.

♪ ♪ (doorbell chimes) But do they have other ways of learning the secrets in my data?

To learn more, I'm tracking down a data security expert in his hacking high-tech superhero lair... naturally.

(door rolling open) Are you Patrick Jackson?

My name's Alok.

Yes, I am.

Awesome, I'm in the right place.

(door rolls shut) Your phone is sending this extra data to these people that you don't know exist.

PATEL: Patrick Jackson has been all over the news for his work as a former NSA research scientist, and is now chief tech officer for the internet security firm Disconnect.

And if anyone can help me understand how my personal data is leaking, it's him.

Patrick, when I think about the main control of my work, life, play, what I'm doing at home, when I'm on the road, this is the mothership.

If I were to relinquish control of this precious device for a few moments, can you show me, like, what I've inadvertently given up?

Yes, yeah.

I can show you what these data companies know about you and what they're collecting.

PATEL (voiceover): Using a hacking technique called a "man-in-the-middle attack," Patrick can intercept the personal data that's leaving my device, essentially eavesdropping on a conversation between me and the websites and applications I use.

JACKSON: Contact information, name, phone number, email address.

When you agree to allow them to have your location, I can see not only where you're at on a map, but also where you're at in your house, whether you're at the back of the house or the front of the house.

When you look at the data leaving the phone, every time you open an app, you send about, maybe, 500 kilobytes of data to their servers.

That is equivalent to about 125 pages of text that you would print in a printer.

PATEL (voiceover): It's one thing if the apps on my phone are collecting data, I chose to download them.

But Patrick says that other companies have even sneakier ways to get my data.

Like something as harmless as a marketing email.

To demonstrate, Patrick sends me a mock promotional email.

I have an email that says "Shoe Sale."

It says "open to view the shoe sale," and I want to open it, so I'm going to.

"Hi, Alok, get ready for upcoming shoe sale."

I like this graphic, and there's like, social media icons.

This looks legit.

(voiceover): It turns out, emails can include a tracking pixel-- also known as a spy or invisible pixel.

JACKSON: An invisible pixel is a type of image you're never intended to see, but it still initiates a handshake of data from your device to these data companies.

(keys clacking) Most of the emails that you receive likely have these tracking pixels in them.

Most?

Most.

This invisible pixel is actually disguised as the banner in that email.

In other cases, the tracking pixel will be a one-pixel, very, very tiny image that you would never see with your eyes, and it's not meant to be seen.

(zooming in) PATEL: That little pixel, that little spy.

See it?

Right there.

It can hide in images embedded in an email, like a banner, or even an "unsubscribe" button.

And when you open the email, it contacts a tracking website to collect data about you.

It can suck up your device model, location, and even some browsing history.

JACKSON: This is essentially a digital fingerprint of your device.

PATEL: No!

JACKSON: That fingerprint would identify you as who you are, and somebody else in the future could look at that fingerprint, make you do a new fingerprint, and they would know that this is the same person.

PATEL: Companies are snatching copies of my digital fingerprints wherever I go online.

And by following that trail... JACKSON: Companies are, over time, collecting everything about you.

That's how they build up this, this digital profile about you.

HILL: The internet is this data collection machine, and as we're moving through the internet, there are these companies whose whole job is to reassemble that trail.

PATEL: So now I know how my digital profile is out there, but why?

Who really cares that I take pictures doing handstands and own way too many sneakers?

Turns out, there's a whole industry devoted to selling my data.

It's the data brokers.

♪ ♪ Data brokers are companies that are set up to collect information, repackage it, and resell it or re-share it to other companies that may want to know information about you.

So what do data brokers want with all our personal data?

Why do they care that I love chicken mole and that "Cool Runnings" is in my top five movies of all-time?

TSUKAYAMA: They collect all this information, and then they're really trying to slice and dice it in ways that are appealing to customers.

You know, it could be an employer who's doing research on you, it could be a retailer who wants to know what kind of customers they can target with ads.

That kind of information is really valuable for advertisers, because they want to target advertising to a certain type of person.

PATEL: Our data ends up eventually getting compiled into reports like these, that are then sold to... whoever's interested?

TSUKAYAMA: Data brokers are able to say, "Look, we have a group of people "that will fit the audience of your product.

"We really are happy to serve this list of people to you," or to make a score about how likely they might be to purchase your product.

Okay, I know people say "Oh, your phones aren't listening to you," but we were just talking about retro video games, and here is an ad for home mini-arcade machines-- which looks kind of cool-- but how did it know we were just talking about that?

Is my phone listening?

Is it a psychic?

What's happening?

People always say, "I was talking about this product, and then I saw an ad for it.

"Matt, are they listening through my phone?"

And I'm like, "Well, they didn't hear you, they didn't listen to anything."

The truth is actually more frightening.

You talked about that thing because they influenced you into having this conversation.

It's because the algorithm took you to this place.

And that's the situation with our data.

PATEL: There have been some outlier examples of ad tech companies listening without consent, but that's against the law.

For the most part, advertising algorithms know you so well that they can predict what you would find interesting.

They are so good because they've studied all the data gathered about you-- from the data brokers.

There's this kind of dossier that's being created about you as you're wandering around the internet, and it's being used to, you know, decide what ad you see.

PATEL: Advertising fuels the economics of the internet.

And advertising is fueled by you, me, us-- our personal data.

So how do the algorithms actually work?

You land on a webpage, and that webpage gets your I.P.

address.

A unique identifier is returned to a data broker.

That data broker looks up all the facts that were ever gleaned about you.

A dossier that describes you.

PATEL: And then advertisers literally bid, they bid on you, in a real-time auction based on the only lesson I remember from Econ 101: supply and demand.

DOCTOROW: The demand-side platform that the advertiser is on says, "I have here "an 18- to 34-year-old man-child "with an Xbox in Southern California.

"Who wants to pay to cram something nonconsensually into his eyeballs?"

And that takes place in a marketplace, and you have advertisers on the other side who have standing orders.

They're like, "I want to advertise to "18- to 34-year-old man-children in Southern California who own Xboxes," and the marketplace conducts an automated high-speed auction where it's just like, "I'll pay so many fractions of a cent," "I'll pay that plus ten percent."

(auction bell rings) The high bidder gets to show you an ad.

PATEL: All of this happens nearly instantly.

And it's possible because data brokers sort and cull personal data into super detailed consumer groups.

This is the process that delivers relevant personalized ads for cute shoes or that new tea club-- if you're into that sort of thing-- which all the ads seem to know about you.

TSUKAYAMA: Here we have, for example, Soccer Mom.

PATEL: Okay.

I might be able to identify with that.

A sporting goods retailer could then go and check out a file on what a Soccer Mom's online activity is like.

TSUKAYAMA: What are the things that they tend to spend money on, and do they like to save?

Are there certain times of year where they might spend more or less?

PATEL: With all this data about Soccer Mom's consumer habits, retailers can send personalized ads with uncanny timing.

Some people like the results-- soccer moms get deals.

Advertisers keep websites we love in business.

But... some consumer categories can be more concerning.

HILL: Sometimes they'll have categories that are like, "This person has erectile dysfunction, "this person has a gambling problem.

"This is a list of, kind of, people that are likely to fall for frauds."

So these can be really powerful and damaging lists.

TSUKAYAMA: So this one, for example, diabetes.

PATEL: Wow.

Okay, healthcare demographic...

The thing about that, right, is like, when you're thinking particularly about health data, that indicates that you're probably in a pretty sensitive situation.

PATEL: I'm now thinking about all the patients I take care of.

And I shudder to think at the targeted ads that are deliberately targeting these individuals.

(keys clacking) TSUKAYAMA: Data brokers have lists about sexual assault victims, they have lists about dementia sufferers.

Those are some really concerning types of categories, and you could definitely see how an advertising company could take advantage of people on those lists.

So I think a lot of people's first reaction on seeing these data broker reports is like, where has all of this come from?

There are a lot of places where data brokers get information.

Most commonly apps that you download that have deals with data brokers to share information.

PATEL: All right, I knew that apps were getting my data, but I had no idea some were sharing it with data brokers.

How is that even legal?

TSUKAYAMA: How often have you seen a terms and conditions screen just like this?

All the time.

Anytime I download anything, basically.

(both chuckle) I download apps all the time for work, play, life, convenience.

I just scroll all the way down and hit accept.

because I'm over it.

Right.

And I think that's how most people feel about it.

PATEL: "By accepting these terms, you allow the platform to freely..." "...content for demonstration, promotion, and..." TSUKAYAMA: Terms and conditions are really long.

Cool, I'm in a commercial and don't even know about it.

TSUKAYAMA: Carnegie Mellon once did a study that said it would take days for somebody to get through all of the terms and conditions.

They actually use the word exploiting.

"You represent and warrant..." TSUKAYAMA: That puts people in a really difficult position when we're supposed to manage our own privacy, but we're also supposed to use all these things that are products that will make our lives better.

(papers rustling, teacup clatters) Data brokers are a big industry.

It's about a $200 billion industry right now.

I think a lot of people expect it to grow to, you know, $400 billion in the next few years.

NOBLE: That level of data from our past, all the things we've done being used and put into systems to help predict our futures, that's unprecedented, and that's rife with the potential for discrimination, for harm, for exclusion.

PATEL: Okay, I know I said that I'm not the type to log in to... (voiceover): Look, I love being online.

I like sharing what I'm up to on social media, and I'm not afraid to share my thoughts.

Okay, bugs, I don't bite you, you don't bite me.

It's that easy.

But some of this personal data is, well, personal.

So, now I need to know: What can I do to make my digital life more private and secure?

GALPERIN: Privacy and security are not the same thing.

For example, uh, Facebook is extremely interested in protecting your security.

They want to make sure that it is always you logging in to your account.

They will go through a great deal of trouble to keep your account secure.

But you enter all kinds of data into that account.

You tell it where you are located.

You send it all of your pictures.

You send messages and Facebook collects all of that data.

They don't want you to keep it private.

They want you to hand it to them so that they can use it in order to serve you targeted ads and make them money.

PATEL (voiceover): My accounts are mostly secure when I control access to them.

But that doesn't mean the data I put in them stays private, far from it.

Privacy and security are not the same.

But they are two sides of the same coin, and I have to understand both if I'm gonna protect my personal data.

MITCHELL: When your privacy is taken from you, your agency is taken from you.

Privacy is that whisper.

When you think you're whispering to your friend, but you're shouting in a crowded elevator, you're robbed of something.

And that's why privacy is so important.

PATEL: What can I do right now to protect my privacy and my security?

To learn tips and tools to preserve my data on both fronts, I'm chatting with hacker and educator Matt Mitchell and cybersecurity expert Eva Galperin.

First up: privacy.

Sorry.

(whispering): Privacy.

Matt is a privacy advocate at CryptoHarlem, as in cryptography, the process of hiding or coding information.

Hey.

I'm Matt.

Thanks for coming to CryptoHarlem.

MITCHELL (voiceover): CryptoHarlem is anti-surveillance workshops for the Black community and all marginalized communities around the world.

And our mission is to develop people's digital skills so they can actually help us in the fight to push back on digital harms.

MITCHELL: Privacy is not secrecy.

Privacy is just a door.

A door in your home.

There's a sense of, like, I want to control what can be seen, what can't be seen just for me.

PATEL (voiceover): And I want to close that door.

So how do I do this?

Even just a little?

PATEL: Okay, what do I do to make all this safer for me?

What do I do, who do I talk to, how do I start?

You have to ask yourself, "Is this a problem that needs to be fixed?"

Privacy isn't a switch.

It's a dial.

You get to control how much you share with who and with what.

PATEL (voiceover): Let's start with a big one, something I use all the time, every day, and I bet you do, too.

Have you ever used this website called Google?

I've heard of it.

Yeah.

Well, let's check this out.

Well, if we go here to myactivity.google.com... ...it'll show us all the things that you've been doing.

So for example, when we go here, we see all the different Google services that you use.

I don't think they make a service you don't use.

PATEL (voiceover): These platforms are so deeply embedded in many of our lives and for good reason.

They make products that can be really useful.

It's hard for me to imagine going a single day without searching the web or using a navigation app.

But they also suck up a lot of our data.

It's a trade-off that I'm comfortable making, within reason.

I've used literally everything Google has ever offered.

And it knows what you've used.

And it records everything you've ever used and how you've used it.

Every search term you've used, every, uh, you know, shopping item you've used.

But this is the dashboard to delete it.

PATEL (voiceover): I didn't know this, but I can literally just delete huge amounts of data that Google is storing about me.

And the same is true for a lot of other services.

We can dial to whatever level we feel comfortable.

For example, on LinkedIn, you would just click on me, and then you would go to your settings and privacy.

Here, when we go to manage your activity, it tells you that, you know, you started sharing your LinkedIn data with a permitted application.

PATEL (voiceover): Treating privacy like a dial means it's not all or nothing.

You can have your data cake and eat it, too.

Like now I'm thinking I want to log into everything-- all my social media, my email, my LinkedIn, everything-- regularly and look to see who is using these.

Exactly, it is about awareness.

Furthermore, the companies, they know how many people actually use the privacy controls.

And by you even peeking in it, you're saying I believe privacy matters.

At the Electronic Frontier Foundation, Eva shows me how I can take my privacy game to the next level... learning some Surveillance Self-Defense.

Although, apparently not that kind of self-defense.

GALPERIN: So, the next step in your privacy journey is fighting back against types of corporate surveillance.

I-- and one of the things that websites really like to do when, uh, is not just to track what you are doing on their website, but to track all the other websites that you go to.

And they do this using cookies.

There's some companies I trust, and I'm like, fine, you have these cookies.

They're chocolate chip.

I know where they were made.

I know what you're doing with them.

But then there's these third party companies, I don't want them around me.

You can use a browser extension to eat these cookies, uh, and fight back against this kind of tracking and keep those websites from seeing where else you're going.

PATEL (voiceover): Browser extensions are add-ons for your web browser that give it extra features and functionality, like eating cookies.

I'm imagining this, like, digital Cookie Monster that's eating up all these pieces of my online activity so that companies don't know what I'm doing online.

And it reduces the amount of privacy tracking.

Am I understanding that?

What these browser extensions do is they get rid of, uh, the tracking cookies that these websites use to see all the other sites that you're going to, which is none of their business.

(knuckles crack) PATEL (voiceover): My personal digital world is starting to feel comfy, controlled and a lot more private.

I've learned how to close the doors and blinds.

But still, someone could open them right back up.

I could get hacked.

How do I lock my doors?

Time to talk about security.

MITCHELL: The tragedy of this recent pandemic teaches us that we're all pretty vulnerable.

And without that herd immunity, without that community response, you can't just say, "I'm okay, and therefore I don't have to worry about this."

This is the first time that I've ever heard someone compare data privacy to epidemiology and herd immunity.

All you need is one person to make a mistake and it's game over.

That's what happens to so many other corporations, businesses, even hospitals during a ransomware attack that'll freeze all machines and stop them from working until someone pays a bunch of hackers.

My one error could compromise the security of my entire institution.

MITCHELL: Human beings will make mistakes.

Folks won't wash their hands sometimes, right?

But we try to teach best practices to prevent the worst.

Okay, Matt, you have my wheels spinning.

I do not want to be patient zero in this, like, massive infectious data leak.

What can I do to start pulling it back and better protecting my information?

Well, I got something for that, okay?

Oh, you have, like, a bag of tricks.

I've got a bag.

I thought you were just gonna say, like, change your password.

We got to go all the way.

This is a privacy screen.

And this will keep people from being able to look over your shoulder.

Shoulder surfers beware.

Can't look through that.

This is for like, using my computer in a public space, the airplane.

Everywhere.

This is a Faraday bag.

You got to keep your phone in here.

This blocks RF signals.

It's basically aluminum foil... PATEL (voiceover): Yo, Matt?

Can we slow this down a little bit?

You can't get hacked when you're not attached to anything.

Is this really necessary, a Faraday bag?

PATEL (voiceover): Okay, this looks a little more complicated than I expected.

I guess I just have to become Dr. 007.

We also have a Wi-Fi pineapple.

This is a portable access point.

And we also could use it to detect and stop access points from going bad.

PATEL (voiceover): Okay, Matt, now you've just gone rogue.

MITCHELL: Let's say you have a hard drive with some important files from work in it.

What happens if you lose it?

Someone can plug that in and have access to all your stuff.

Not if it's an encrypted hard drive.

I understand-- There's more.

How do you know that you're not being bugged?

This is nuts.

This is something I could use to find out if there is a audio bug in the room.

(beeping) I can find Wi-Fi signals... (device beeps) Oops, something's here, right?

PATEL (voiceover): Honestly, I thought being a spy would be more fun.

But I'm starting to feel shaken, not stirred.

How am I supposed to keep track of all this stuff?

I'm no hacker genius like Matt.

What if I just left all of this behind and just quit.

Goodbye, digital world.

(clock ticking) (yawning) Do you know if there's breaking news?

(cat meows) Look in my eyes and tell me.

What are we doing here?

What are we doing?

Like, I don't even know how many steps I've taken today.

Because my step counter is not on my hand.

I'm technically disconnected, this isn't cheating, but can someone tell me what the Suns score is?

CREW MEMBER: Uh, down by 11 at the half.

(groans) (cat purring) Oh, I am supposed to pick up my daughter.

How long do I have to do this for?

(voiceover): All right, maybe it's not that easy.

But there's got to be some middle ground between Inspector Gadget and Fred Flintstone that's right for me.

Instead of going completely off the grid, I'm checking back in with Eva for some more surveillance self-defense.

And the best place to start is with the basics: passwords.

I'll be honest, my current password is basically a combination of my first pet's name plus my birthday or a favorite video game or song.

I don't think any hacker's really gonna guess that.

But you're telling me that there is still a vulnerability there.

Yes.

Hackers can go find out information about you from data brokers, including, you know, the name of the street you grew up on or the city where you went to college.

So you wouldn't want a password like the name of your pet.

Or password123.

Well, I did have a pet fish, and his name was Password123.

So, I guess that kind of, like, hits both boxes and makes me more vulnerable.

Let's start by, uh, creating some strong and unique passwords for all of your, uh, your different accounts.

And that will make them much more hacker-proof.

I'm all ears.

Fantastic.

Well, we're going to start by rolling these five dice.

GALPERIN (voiceover): There are easy ways to create passwords that are long and strong and easy to remember that are not based on information that attackers can easily find about you.

And the way that we do that is we use word lists and dice.

The word list is essentially just a long list of dictionary words with numbers attached.

So what we're going to do is we're going to write down the numbers on this dice.

45263, my new lucky numbers.

Okay.

And now we are going to look up 45263 in this book.

So there are words that correlate to the numbers that I just randomly rolled.

Yes.

Okay.

I want a cool word like "tiger."

The word is "presoak."

"Presoak?"

"Presoak."

34115.

"Henna."

Okay, I like this.

PATEL (voiceover): The idea behind this dice game is that it's both random and long.

Hackers using fast, powerful computers and sophisticated password-cracking software are able to try many, many passwords a second.

A recent study by a security firm showed that a seven-character password can be cracked in just a few seconds.

But a 12-character password with uppercase letters and symbols is much more difficult to break.

Studies show it could take hackers well over 100 years to crack.

That's safe.

But also more difficult to type or remember.

Eva's six-word random passphrase is easier to remember than a random string of 12 characters and practically impossible to break.

"Stinging."

"Ignition."

Six is "Clutch."

"Clutch," okay.

"Presoak Henna Stinging Ignition Clutch Handbrake."

(bell dings) Fantastic.

Now you have a passphrase.

These six words.

It is long.

It's unique.

It's difficult to guess.

And it's relatively easy to remember, considering how long it is.

It is a very good way of creating random passwords, but a lot of password managers will automatically do this for you.

PATEL (voiceover): Once you have a passphrase, you can use this to unlock a password manager that generates strong random passwords and stores them securely.

Now I have this beautiful random password or passphrase, but what happens if someone steals this?

Is it just game over, efforts are gone?

No, it is not.

Uh, that leads us to the next step on your surveillance self-defense journey, and that is two-factor authentication.

PATEL (voiceover): This may sound like a hacker ninja term, but it's just an added layer of security, requiring an additional method of confirming your identity.

Most of the time, it's just a simple text message.

GALPERIN: Because it requires that you have two things in order to log into your account.

You will need both your password and also this code, so the site will send you a text message.

There is also an authenticator app.

The site will ask you to take a photo of and then go to the site in a QR code.

The best way to be a security superhero is to find the stuff that works for you and implement it as sort of smoothly and seamlessly as you can.

PATEL (voiceover): These data self-defense tweaks are great for me and my own data.

But what about everyone else?

I'm wondering, is there a way for all of us to share data and get all the sweet benefits, without sacrificing privacy and security?

At M.I.T.

's Media Lab, I'm meeting up with Ramesh Raskar, who is working on a way to access the benefits of personal health data-- finally, a topic I understand-- without compromising our private information.

At Ramesh's Camera Culture Lab, they're building some data collecting tools that seem straight out of a science fiction movie.

PATEL: Love when a sign says "Danger: Laser."

You know important things are happening in here.

(voiceover): They've got cameras that can literally see around corners.

PATEL: Get out!

(both laughing) RASKAR: We are not violating the laws of physics.

PATEL (voiceover): And cameras that can see inside our own bodies.

That's about as personal as it gets.

For Ramesh, protecting patient privacy is paramount.

But he's found a drawback in how we do that.

Since data is locked up for privacy, advancement in medical science is not as fast as it could be.

Because, think about it, access to tons of personal health data could help researchers make major medical breakthroughs.

But today, researchers have to ask for your consent to peek at your data in order to learn from it.

RASKAR: When we talk about consent, someone's still peeking into your data.

A no-peek privacy, on the other hand, is where nobody can peek at your data.

PATEL (voiceover): No-peek privacy?

But how could researchers learn anything?

RASKAR: There are many ways to create no-peek privacy.

First one is the notion of smashing information.

PATEL (voiceover): No, not literally smashing your phone.

But I'm not gonna lie... ...that was really fun.

Smashing is basically the idea of taking raw data and smashing it into just the wisdom.

PATEL (voiceover): According to Ramesh, smashing data is simply the process of extracting the useful information, which he calls the "wisdom," while obscuring the private data.

In other words, a collection of private health records contains two kinds of data.

One kind is the personal data-- the names, conditions, and histories, the stuff we absolutely want to protect.

But collectively, the records may contain valuable information about patterns in health care.

The wisdom.

I'm thinking about examples in health care, and the individual data, the patient data is protected, and you can't reverse engineer it.

Let's take a concrete example of COVID.

Imagine during the early days of the pandemic, we could have sent medical experts from here in Boston to China, to Korea, to Italy, and embedded them in those hospitals to understand what COVID pneumonia looks like on a chest X-ray.

And they could have come back to Boston, all those medical experts, and said, "Hey, together, we can figure out what this is."

PATEL (voiceover): So, the experts would return back with just the wisdom, an understanding of COVID derived from being exposed to large data sets.

But they wouldn't come back with specific patient info.

None of the raw, sensitive, and private data.

But of course, that would require initially sharing patient data; a non-starter.

Because of privacy, because of regulations, because of national security issues, they couldn't.

PATEL (voiceover): This is where A.I., Artificial Intelligence, comes in.

Instead of sending experts to each hospital, Ramesh is working on a way to send A.I.

to learn instead.

An A.I.

model could be trained on patients' lung X-rays to learn what signs of COVID look like.

The private health data would never be copied and would never leave the hospital or the patient's file.

The A.I.

would only transmit its conclusions, the wisdom, the smashed data.

RASKAR: It's not enough to just remove the name from the chest X-ray, but make sure that you don't send any of the pixels of the chest X-ray at all.

PATEL (voiceover): The A.I.

can learn patterns and gain knowledge without having to keep hold of everyone's data.

So the "wisdom" from one hospital can be combined with the "wisdom" of others.

RASKAR: Achieving privacy and benefits of the data simultaneously, it's like having a cake and eating it, too; it's available.

And it's just a matter of convincing large companies to play along those rules.

PATEL: Smashed data is one way we can learn to stop worrying and love sharing our personal data.

But every corporate network would have to agree to smash our raw data.

I'm not convinced we should wait around for big tech companies to do this.

HILL: The big technology companies, they have built the infrastructure of the whole internet.

You're not just interacting with these companies when you know you're interacting with them.

PATEL: Even if it seems like you're on a totally independent website, big tech still sees you.

For example, tons of websites, like some of the ones owned by NASA, Pfizer, BMW, even PBS, use Amazon Web Services, which means Amazon gets some data when you visit them.

Or when you visit any app on your iPhone, Apple knows.

Also, every time you've been to a webpage that has a Facebook "like" button, Facebook gets to gobble up your personal data.

KAHLE: So it may seem like the web is decentralized because it comes from many different places.

But in fact, there's centralized points of control.

CHOWDHURY: Right now, for example, when you are in a social media app, you're sort of locked in, right?

All your information is on there.

It's hard to leave a social media app because you're like, "All my friends are there, all my photos are there.

"If I move to another app, I have to rebuild that community."

GALPERIN: Those social media websites are controlled by a very small number of companies.

And the rules about using those websites, who has access to them and what kind of behavior is acceptable on them, are set by the websites themselves.

PATEL: This centralized data monopoly, how do we start to dismantle it?

That's exactly what proponents of an idea called the decentralized web want to do.

GALPERIN: The decentralized web is sort of our antidote, the antithesis of the web as we now think of it.

CHRISTINE LEMMER-WEBBER: The decentralized web can be seen in contrast to the centralized web, of course.

Instead of what has become, on the internet, of a few big players kind of controlling a lot of the web and the internet space, we're really kind of rolling things back to kind of what the vision of the internet was.

PATEL: I'm wondering what a decentralized web would look and feel like?

So I'm meeting up with coder Christine Lemmer-Webber, who is working on writing the standards and rules for how social media could work on a decentralized web.

LEMMER-WEBBER: Most people are familiar with social networks: you know, they've used, you know, X-slash-Twitter; they've used Facebook; they've used Instagram.

The decentralized social web is like that, but no one company, no one gatekeeper controls the thing.

We want to be able to have all of our different social media sites, all of our different online communication tools be able to talk to each other.

DOCTOROW: A decentralized web is one that is focused on the self-determination of users.

You're not locked in.

So you find a service, and you like it.

(duck quacks) And then you and they start to part ways.

The art you made, the stories you told are there.

In a decentralized web, you go somewhere else.

You go somewhere else, and you don't lose any of that.

PATEL (voiceover): But imagine, instead of having one Facebook-type company, we each had our own data live on our own devices, and it was easy to join or merge with others, or disconnect from them.

Leaving one group and joining another wouldn't mean rebuilding everything from scratch because your data moves with you.

It sounds like a tech fantasy.

But it's actually something we've already proven works online.

Consider something you may use every day, or if you're like me, every minute: email.

LEMMER-WEBBER: So what a lot of people don't realize is that they use decentralized networks every day.

It doesn't matter if somebody's on Gmail, or if they're on Hotmail, they're on their university email.

They don't even have to think about it.

They type an email to their friend, and they send it off, and it gets there, right?

At the heart of it, that's kind of the basics of what we're doing.

PATEL: In other words, you can get an email sent from Hotmail even if you have a Gmail account.

Or you can create your own email server, for that matter.

It doesn't matter what email service you use because the protocol, the rules, are written to allow the email servers to talk to one another.

LEMMER-WEBBER: That's because there's a shared protocol that says, here's how we get the messages from place to place.

Social networks could just work like email.

PATEL: And in fact, there are plenty of decentralized projects out there like Mastodon and Blue Sky putting the user's profile and data back into the users' hands.

LEMMER-WEBBER: In the systems we're moving towards that will be much more the case where private communication is much more private.

They're, by default, secure in that type of way.

We're building new foundations for the internet that allow for healthier, safer, more decentralized systems, gatekeeper-free.

That's the vision and the future we're trying to build.

PATEL: No doubt, there are secrets in your data.

NOBLE: Everything we touch is increasingly datafied, every dimension of our lives.

CHOWDHURY: All of this data goes into feed algorithms.

And algorithms make predictions about how long you will live, or your health, or your lifestyle.

PATEL (voiceover): And while I learned how to protect my personal privacy and security, there's only so much I can do myself.

HILL: There are things that individuals can do to protect their privacy.

Ultimately, in order to avoid a huge crisis, it requires systemic change.

GALPERIN: There are limits to what we can do as individuals.

There are also things that need to be addressed through regulation, through litigation, and through legislation in order to make all of us safer.

PATEL: It's comforting to know there are techies out there trying to protect us and our data, designing new ways to enjoy the fun and convenience of the digital world without being exploited.

KAHLE: New technologies, new games can proliferate without centralized points of control.

That's the excitement of the decentralized web.

LEMMER-WEBBER: I can't wait for people to see this vision we're building for collaborative, more consensual, decentralized social networks.

That's going to be really exciting.

PATEL: The future we're building might not look too different from the internet of today.

But it could be much more private and secure, if we get it right.

DOCTOROW: This is about how technological self-determination and regulation work together to make a world that is more safe for human habitation.

♪ ♪ ♪ ♪ ♪ ♪ ♪ ♪ ♪ ♪ ♪ ♪