reCAPTCHA: A Deceptive Tool for Mass Surveillance

how does this checkbox know that I'm not a robot I didn't click any motorcycles traffic lights I didn't even type in distorted words and yet it knew this Infamous Tech is called recapture and when it comes to reach few tools rival its presence across the web it's on 12 and2 million websites quietly sitting on pages that you visit every day and it's actually not very good at stopping [Music] BTS which of course led me to the question if it's not stopping Bots what is it doing this simple question sent us down a rabbit hole that was deeper and more complicated than we ever imagined the Box test isn't really about the Box a single check box it turns out recapture isn't what we think it is and the public narrative around recapt is an impossibly small sliver of the truth and by accepting that sliver as the full truth we've all been misled TR your mouse movements for months we followed the data We examined gloss over research and uncovered evidence that most people don't know exists this isn't the story of an inconsequential box it's the story of a seemingly innocent tool and how it became a Gateway for corporate greed and mass surveillance we found buried lawsuits Whispers of the NSA and goes of Edward Snowden this is the story of the future of the internet and who's trying to control it why can't a robot work out how to tick a box marked I'm not a robot in the largest antitrust trial in the United States in 25 [Music] years let's start here what you've been told is wrong journalists told you such a small sliver of the truth that I would consider it to be deceptive why can't a robot just click I'm not a robot the Box test isn't really about the box it actually tracks your mouse movements right before you check the box see if you run code to make an object move to a certain point like a cursor the simplest version will make it move in a straight line robots move like this but humans naturally aren't that accurate we don't move in a perfect L straight line but humans move kind of like this humans tend to move their mice in Wiggly imperfect ways and that is what this version of capture was looking for okay Mouse macro software find image look for the checkbox move Mouse to checkbox and make it click play [Music] I mean it's so easy it's so easy to test this okay you're probably thinking why does any of this matter and I agree with you I did agree with you I actually halted this investigation for a few weeks because I thought it was quite boring until I went to renew my [Music] passport passport status. state. gov I got a capture not a checkbox not fire hydrants but the old one and I clicked it and it took me here recapture seems to have become a spyware it might be also that its primary purpose is doxing of us residents and spying on everyone [Music] else I don't know what led me to do it it felt like my mouse was moving itself an entire page dedicated to documenting the horrors of recapture alleging National Security implications for the US and foreign governments its ability to Doc's users mentioning secret fisa orders the same type of orders that Edward Snowden risked his life to warn us about it is one of the most secretive places in America a federal court of 11 judges with the power to allow government to conduct electronic surveillance on you who put this together Anonymous if you're a web native journalist looking to get in touch we doubt you're going to have a hard time figuring out who we are anyway this felt like a key left in plain sight Whispering there's a door nearby and it's meant to be open this is what we're good at this is what we do it felt like someone on the other side already knew that as if they'd been waiting for someone to come along and notice okay let's get this out of the way recapture is not and really has never been very good at stopping Bots recapture was founded in part by this guy in 2007 version one looked like this in 2009 Google bot recapture but in 2012 hackers were able to get bots through with a 99.

1 % success rate V2 dropped in 2014 it was the first time we saw the infamous check boox this is also when it allegedly became spyware in 2017 version 2 was cracked with an 85% success rate the code to do so was made public and still works To This Day 2018 was the launch of V3 according to researchers at UC Irvine there's practically no difference between V2 and V3 a few months after the launch of V3 it was beaten with with a 97% success rate Google doesn't tell us how recapture Works besides using an advanced risk analysis engine but these hackers they spelled it out do you believe that recapture should be thrown out yeah I think it's time to deprecate this technology this is DrAndrew surles and he's the lead author of this study and so I essentially developed a mirror of recapture that would make you have to solve m mple in a row and would tell you that you're wrong regardless of what you said and showed some of the data that you can actually scrape you can scrape so much data from somebody's user interaction from a website whoa this has been my big question what data is Google collecting they can collect all sorts of data right any information any keystroke any click IP address user agent string all the websites all the browsing history cookie information recapture takes a pixel by pixel fingerprint of your browser a realtime map of everything you do on the internet I think it's like 10 million websites employ this technology they essentially get access to any user interaction on that web page are you saying that Google can see anything that anyone is doing on any website that has recapture embedded in it there's a very good chance they have that capability is what I will say recapture doesn't need to be good at stopping Bots because it knows who you are the new recapture runs in the background is invisible and only shows challenges to bots or suspicious users if there's any part of this video you should listen to It's this stop making dinner stop scrolling on your phone and please listen when I tell you that recapture is watching you I'm not saying that in some abstract metaphorical way right now recapture is watching you it knows that you're watching me and it doesn't want you to know it's not just Google now there is this whole sketchy Market about Brokers advertising Brokers that like to purchase large amounts of people's information these Brokers have information on probably all of us they get this data from a variety of sources government records like your birth certificate your voter registration court documents or social media the posts you've made the post you liked the quizzes you've taken the websites you visited they package all of this together and they sell it they're not just selling this to advertisers many are selling it to whoever will pay for it so I use a tool called delete me they're also graciously sponsoring this portion of today's video delete me goes through the strenuous steps of getting your data removed from hundreds of these data broker websites just in my first month delete me searched 3 and a 12,000 listings for my personal information and they found data on me on 55 different data broker websites and then they got it removed on my behalf my favorite thing about this is that it's not a one-time deal delete me routinely checks different data broker websites to see if they post anything new on me and then they get it removed I don't have to do a thing because they've sponsored this portion of today's video delete me is offering a 20% discount to you if you use the link down below it's join delet me. com ch20 or you can use code chule 20 at checkout so if you don't like the idea of Corporations selling your personally identifiable information for financial gain and you see the potential risks of the data economy use that link you'll get 20% off and you'll get your first report back in 7 days thank you to delete me I'm seriously genuinely really impressed with what you all do [Music] in January of 2015 a class action lawsuit was filed against Google the allegations claim that every time someone solved a recapture challenge they weren't just proving that they were human but they were performing unpaid labor for Google without their knowledge look at this typing mourning overlooks would get you a passing grade obviously but so would adorning overlooks and pouring overlooks looks even egg overlooks horse overlooks Blue Man Group overlooks all of them will get you a passing grade and confirm you're a human recapture is testing you on this word alone it has no idea what this one is you on the other hand do and when you submit the word morning you are fulfilling a contractual obligation that Google has with one of its clients like the New York Times and when you do this you are helping to train one of Google's AI data sets as one researcher says you are doing unpaid labor that directly benefits the world's most powerful surveillance Corporation and even though the judge acknowledged this to be true the class action lawsuit was dropped in large part because the time involved for each user is extremely small as a part of Drsur's study they estimated that users have spent more than 819 million hours taking these tests which results in $6.