Very, very nice to see you. I want to point out, for the people at home who can't see, she is wearing a "Let's sue the government!" T-shirt.
We have great designers at EFF. They made this special.
What is EFF? And what is that?
The Electronic Frontier Foundation is the world's biggest and oldest digital rights organization. We were founded in 1990. Our basic goal is to make sure that when you go online, your rights go with you. So we do things around free speech, around privacy, and around trying to build an internet that stands with you rather than against you.
How did you know? It's so prescient, the idea. I'm thinking back to 1990. And the internet was, you had a little AOL disk, yeah? Or maybe '95 or '96, whatever that was.
It might have been, it was just like all binary message boards. How did you all have the prescience to see that this could be turned into a tool of surveillance and of government repression?
I mean, the founders of the EFF, John Perry Barlow, John Gilmore, and Mitch Kapor, were involved in some early FBI missteps around the internet. And they...
They worked with the FBI or they were, like, hacker dudes?
No. They were, like, questioned by the FBI, and there were a lot of raids going on. And they weren't raided, but they were asked a bunch of questions. And they realized that the government didn't really understand how the internet was working either, or at least the FBI didn't. And they thought, we need to start an organization that's going to think about how our civil liberties work in the digital age. And a couple of them are pretty geeky, and they realized that the internet we were building was not very secure. It didn't have a lot of privacy or security in it. And the first fight we did was to try to free up a technology called encryption that now is the reason that we have the privacy and security we have online. Most of it.
This is your first lawsuit. And you joined this because you're a lawyer, and you're interested in this space, or you had met these guys? How did your involvement...
I met them kind of by chance. Honestly, they showed up at a party at my house, some of them. But I...
This is all sounding very... where did this take place?
San Francisco, in the Haight.
Yeah, yeah. Now I'm understanding. So there's a tub of Kool-Aid, and somebody puts something in something.
It got a little messy. No, I was a human rights lawyer. I had done human rights. I'd been in Geneva. And I came back to San Francisco to try to start a regular law practice. And I met some of these guys, kind of really by chance. And they were already online. This was 1990, 1991. They were online at this very early internet before we had the World Wide Web. But they were doing really cool things. They were collaborating across distance. They were having these long chats back. And it was stuff that we take for granted now. But it was pretty magical back then.
It's really interesting too that they, and you, decided, because I remember that time as a gold rush. So the '90s, as it started, this was when. Like every internet startup, anybody that you knew that was even adjacent, if they had a word processor, they were a startup. And they wanted VC funding, and they were going to make a ton of money. And you and this group decide we're not going in that direction. We're going to go in the protecting citizens' rights direction, where the real money is. Why would you...
Yeah. (Sarcastically) My stock options are so great.
I mean, look, I think that there are people who, plenty of people in the early internet were interested in making money. I don't have any judgment about that. But we were thinking about how could this be a technology that supports people, how it could be a technology of freedom, how it could give people more power against the powerful forces in their lives. And they were, again, very forward looking. And they created an organization to try to do that. I don't know where it comes from. And for me, I've always just wanted to make the world better. And then I found, I'm not a technical person, but I kind of landed in this place and this time.
You land there also in '90. And then, so you're working over this sort of decade, and you get this great encryption case. And you make it so that people have a right to encrypt their data and these kinds of things. But then 9/11 happens, and that really supercharges the surveillance state.
Yeah. After 9/11, the Patriot Act, both the Patriot Act, which they did aboveboard, and a lot of stuff that we later discovered, as a country, they were doing secretly, really.
These metadata, these hoovering up of all of our data and putting it through process.
Yeah, tapping into the internet backbone, collecting metadata, collecting telephone records. Some of this, you might be able to read in the Patriot Act, but most of it was really under secret interpretations and things like that. But they had really flipped from the idea that you needed probable cause, you needed a warrant, you needed individualized suspicion, to doing mass surveillance first and figuring out what they need second. And that has only increased as the technology has increased.
Was it that they had decided to treat the virtual world as separate from the physical world? In other words, the rules of, like, the Fourth Amendment might not apply to your digital life in the way that it would apply to your house.
Yeah. Although, they were using some earlier stuff that's in the nondigital world, this idea that metadata isn't protected, but the content.
Metadata meaning, like, the date and time and location and the other things that go along with your digital life?
Correct. But they were using an analogy from envelopes and letters in the actual physical world. But in the digital world, the metadata is much more powerful. It can tell you a lot. There's a very famous quote from a member of the NSA saying, we kill people with metadata, right? Because when you are able to collect it at scale and analyze it, you can do a lot more with it than the old-school envelopes, you know.
Yeah. I don't remember anybody saying we kill people with envelopes.
It hasn't happened that I know of. But, so this is one of the things. They took this distinction that is actually an offline distinction that may have made some sense. I'm not sure it did. But in the online world, it really has eroded our privacy. And it's being used in ways now that are increasingly visible, right? I mean, there's testimony in Oregon just last month from an ICE agent saying they used a Google-like thing to identify where people were, that they ended up doing an ICE raid. And the company, Palantir, is very proud of the fact that they're sending metadata to accomplish those things, that these large tech companies are working with the.
So now is your fight, are you fighting two behemoths? Are you fighting the government and also the tech companies?
Absolutely. I mean, we kind of always were, right? If you think about the post-9/11 surveillance, they didn't come to us and ask us for telephone records. They went to the telephone companies. That's where they got it. So they've always gone through the companies that provide us services in order to get information. But now the number one purchaser of information from data brokers is the government. And, you know, FBI Director Kash Patel just said to Congress, we're going to keep doing it. So it was something they were doing a little of, and now they're really supercharging it and doing it at a level that's much greater than it was before. But you're right. We don't really have the luxury of a choice about whether we care more about government surveillance or private surveillance. They work hand in hand and kind of always have.
How receptive have the courts been to the arguments that people's privacy is part and parcel to their security?
I mean, good and bad. I think we've got a Supreme Court that's somewhat hostile to the idea that privacy is a harm at all. But we see a lot of lower courts being courageous. I mean, in many other issues, we're seeing the same dynamic, where we've got a lot of lower courts who are worried about people's privacy, both in the commercial, you know, context and in the law enforcement context. We've been chipping away at this post-9/11 surveillance. We've made a lot of progress over time, not in one fell swoop, but chipping away and chipping away. And Congress has stepped in and done a little. They need to do a lot more. And there's a big vote coming up in April on some of the mass surveillance. That's called FISA Section 702. So it's, we're continuing the fight. We have to continue the fight. But we've also come quite a ways from where we were right after 9/11, where all this stuff was secret and massive.
What do you want people to know? How are we culpable in the dismantling of our own security? And by that, I mean I don't understand at all. I just click Sure. Like, whenever it always comes on, like, you know, is it OK if we try, and I'm just like, I just want to buy [BLEEP] shoes. Like, so I just click, and I do things. And I'm just, I don't know what I've given up.
Yeah. I really think that's blaming the victim. You're the victim here.
Oh, thank god. This is cooked.
This is not set up so you have a real choice, right?
And so we need to fix this. But we need to fix it with law, with policy, maybe with better technologies. But, like, I think that the idea that individuals should bear responsibility for this, it's pretty far down on the list of things.
Because it's not like we have other options, right?
I mean, we do for some things. I think it's great if you want to use an end-to-end encrypted tool like Signal rather than a tool that's not. There are tools that can help you. But I don't think that you should be blamed, because the game is rigged against you on a lot of these privacy things. And the original, I think one of the original sins of the internet is everything is these little click wraps, where, I think somebody did a study. It would take you 37 years to read all the terms of service that you agree to in an ordinary internet experience. That's crazy, because I'm halfway through. I'm about halfway through. It's not fair, and it's not right. We have to fix this with something other than personal responsibility.
So who, who bears that responsibility then? Who is, if I'm the victim, who is the party that I'm going after? Am I going after Palantir? Am I going after, they just had this big lawsuit where, I think Meta was held responsible for certain, so they get held responsible for that. Or is it that, what am I trying to prevent? Am I trying to prevent the government from getting access to all of this data that should be proprietary for me? Am I trying to keep Meta and X and Instagram and all those other mega-corporations or Palantir from being able to, or even AI, look, AI supercharges things. Here's what's crazy. So AI basically runs on, it's basically strip mining the totality of human existence. It basically takes everything that we have ever accomplished through chemistry and poetry and art and music, and it's fed into it. And it gets to take everything that we are, almost our essence. And then if you ask OpenAI, well, what are you doing with it? They go, that's proprietary.
Well, so there's a few things there. And there's a lot going on in that question, but.
I'm sorry, you are the victim. And the first thing that you need to say is I want a comprehensive privacy law. I want a law that limits what these companies can track us, just limits it. We can do this. We don't need a surveillance business model. Moses didn't come down from the mountain with stone tablets that says, the only way to make money on the internet is by spying on everyone. So that's the good news. We can do better.
