Yeah. That is why the SWIFT consortium started to search for solutions how to have an easy, pluggable… if there is an easy pluggable way to just encrypt this stuff. Then they found pEp and started to now do proof of concepts with us. We are now working already with ...

And then the damage was like 100 million in one case and stuff like that.

And there were very big hacks based on that that – people just altered messages and stuff like that, or just injected their own.

There are now projects with banks. We were even in talks now with the Swiss National Bank a few days ago, which went well. They want to secure like their SWIFT network, because the messages are floating around, ehm, without integrity and authentication at the moment.

So, we can, by situation, use, let us say, PGP for email, because that is the default there, but if we add the XMPP transport, you can use OTR, or OMEMO. Or you can also use Signal Protocol for like messaging. That is completely open from the very beginning, and ...

The point now, which I wanted to come to and connect it with that banking thing, is that pEp is a very general approach. It is agnostic to message formats and agnostic to the concrete crypto.

Yes, and it is also good for security, but bad for privacy, so it is not the same.

Also, I was at the IETF… I came over Singapore – I was at the IETF, by the way. There are really big discussions also in the plenary sessions about the privacy issues which are being introduced by these approaches.

Yeah, that is also a discussion going on. [laughs]

There are other things like GNS, GNU Name System – a decentralized name system, even with query privacy. So, the discussions we have now with DNSSEC and stuff… you still have the issue that one side can still know who was asking for something, so that can be solved there.

That is a really great project. There are lots of really great academic papers on that. It is not just about messaging, here is a subsystem called CADET, which is for end-to-end encrypted messages.

It is a good starting point. Then we want to get rid of SMTP and IMAP, let us say… and send the messages through a peer-to-peer framework. For that, we are collaborating with a project which is called GNUnet – that is an official GNU package.

We do it without centralized, let us say, component architecture or something, because we just want to have it as peer-to-peer as possible. And email is not our goal – to say it directly here. It is just… for us… a good starting point, because it is the biggest federated ...

In a sense, yes, but we do it…

It is very easy. Of course, you have all these interoperability issues. You need to be compatible with some…

Yeah, if you want, yeah. Yes, exactly.

The public key gets attached. On the other side, if you have pEp, it gets automatically imported, so that you can just engage as soon as possible in encrypted communications, except, of course…

…and also for GNOME, for the Geary Mail User Agent… we are also financing someone there to just put it in – is that, when you have email addresses, that you get the key pairs automatically generated.

What we are just now doing on all kind of platforms – iOS, Android, Outlook… there is also for Enigmail, there is also pEp mode, which gets activated by default…

We started that project with the idea to automatize – in the first place – email encryption, because you know, if people do not have the public key … you somehow need to make them to get it, and key servers are broken… I mean, SKS key server system is ...

There is something interesting… I am also involved in a project called pretty Easy privacy, pEp.

Yeah, yeah.

OK, so I need to…

Which kind of transactions are they? Are these like bank transfers, or is it about hacking the banks at the endpoints?

Yeah. I have a question! You said at some point – you also wrote it in some other transcript – that you are running tests to secure your financial system. What does that mean? Is it about the transactions?

I think we are talking to the right person here. That is more a problem with the normal politicians that do not get it at all. They also think they can put backdoors and that they are the only ones who have access.

Yeah, I think the company changed…

I am not sure if Taiwan was involved there, ordering that. It was bugged in a way that the Germans and Americans could read all these diplomatic communications. And well, that is fucked up. That is why closed source crypto is no solution.

It provided communication devices to, I think, over 130 countries.

…I think that could be interesting for people interested in that topic, where it shows that after the Second World War, Switzerland and the US had like very interesting relations. There was also a company called “Crypto AG”.

OK, interesting, yeah. Because just to show that Switzerland… I mean, Switzerland is always known as an independent country, blah, blah.

ECHELON is like the Five Eyes concept of that.

Yeah, interception stations.

What about satellite-based communications? Are there antennas in Taiwan or a site where they are surveilling what is going on over satellite-based communications? That is something which I think you meant.

Yeah, of course.

We are also challenging this law – at this area with selector searches – because it is just overkill, let us say. I mean, we are not against… if you know that someone is doing something…

That is, by the way, also the point in Switzerland, because this Secret Service Law – “Nachrichtendienstgesetz”, NDG – was passed with like 60-something percent, so quite a lot, even if it really has extreme instruments in there which are not very compatible with Human Rights.

Well, it is happening everywhere, anyways.

OK.

They can also be , like the content search, so-called. That is what the Five Eyes call it, soft selectors. They can do both, hard selector search and soft selector searches. We know that the false positive rates are catastrophic, of course, but they are doing it. And the question ...

No, in Switzerland, it is both. It can be hard selectors, if you know like “These email addresses are communicating, let us search for that kind of stuff.” Then, of course, you pass through everything, anyway… so it is a “needle in a haystack” search, what you are doing in ...

That means, like words or other kind of patterns. The question is, is Taiwan also engaged in such…

The other thing I mean – with mass surveillance in that sense – is that they can search like the data flows which go through fiber-optic cables, which pass through the borders outside Switzerland: they do that by forcing the ISPs to give them… well, yeah… the bulk data, basically… ...

I mean, they would have the job to tell to several government agencies, “Sorry, we know that you can be attacked. There are lie zero-days with remote exploit capabilities and stuff like that.” So, that is like a contradiction there.

Also, these MELANI guys, for example… what will they do? Because they are not really independent of the Swiss Secret Service, which is called NBD, “Nachrichtendienst des Bundes”. They are not really independent of that thing. If they know that the NBD has like zero-days on stock, and they can ...

If you consider that, if they want to enter into a system which is well-secured, they need to buy zero-day exploits. Then they have knowledge about how to attack systems.

That is already…