The Fight Against AI-Powered Surveillance with EFF's Cindy Cohn and Adam Savage

Oh, thank you. Thank you for that kind introduction.

Thank you.

Wow. It's a good time.

It sure was in the Haight.

Yeah. I had some hackers show up at a party. They knew my new roommate, and yeah. And I got sent on this whole adventure when I was kind of on the pathway to be a corporate lawyer at human rights stuff, and these people were just fascinating. And they were building the future.

Yeah, a lot of people think of privacy as like the Harry Potter kind of cloak of invisibility that you throw over your head when you're about to do something you don't want anybody to see. And it definitely is that sometimes. But I think privacy is important because it's a way for people with less power to have some protection against people who have more power. And you can kind of think about this in different sizes. And the smallest size is actually in the home. My colleague Eva Galperin works with domestic violence victims who are dealing with abusers who put spyware, malware on their devices so that they can keep control over them. And these people need privacy literally, often to save their own lives and the lives of their children and to get out of a dangerous situation. Why? Because somebody who has more power over them is using surveillance to have control over them. And then you can go up to what we're seeing now with a lot of corporate surveillance, which is a way for corporations to know more about you so that they can decide increasingly how much you pay for things, but maybe what you want to buy—I mean, they definitely do that—but also just get a profile of you so that they have more control over the transactions and your lives than you do at some point. Or at least they want to have leverage over you. And then we go all the way up to governments. And the very first thing that authoritarian governments usually do is double down on surveillance. Why? Because they want to keep people powerless. They want to make sure people can't organize, talk to each other, and, you know, quite literally, you know, get together to vote the bums out. Right. And you see this all over the world, but where I think we're really living with it in the United States today, it's no surprise to me that what we're seeing with the Trump administration is increasing efforts to try to surveil us there. The government is now the number one purchaser of information from data brokers. And they're using that information to target where they're doing their immigration sweeps and other kinds of things that people are increasingly seeing. So if you start to think about privacy as a way for people with less power to get protection against people with more power, I think you can see why it's embedded in our constitutional systems, why it's just fundamental to self-government that we have some privacy. And to me, that's, you know, that's far more important than I think a lot of people give it. You know, people often think about privacy. I often say that if you're at a policy debate and somebody says, well, we have to weigh privacy against blah, whatever, blah is going to win. Like, that's just your sign that privacy is going down. And I think we really need to lift it back up again because I think it's fundamental to self-government.

Yeah. And I think that that is really problematic, right? I mean, again, if you're a person with ultimate power, big power, maybe you don't need privacy, but I will note that the billionaires often have more privacy than the rest of us. So there's something there. But, you know, I think that that can seem like a fairly easy thing to say if you're somebody who really has power already in society. I think the lower you head down to people with less and less power, you'll find less and less of that statement. And certainly when you're having privacy, you know, we've recently seen a mother and her daughter in Nebraska where the mother went to jail for two years for having a conversation over Facebook Messenger with the daughter about the right to have an abortion. I suspect a couple years before that, that mother would have thought she had nothing to hide. So she had nothing to fear, right? It's a moving target, and we're in times when it's moving pretty fast. So even if you think that way today, I would be a little hesitant to think that that's a safe position to take for the long run.

Well, I think right now people get wrong about privacy that it's kind of a nice-to-have rather than essential. Yeah. Or maybe even not a necessary thing for people's lives. And usually that kind of comes from a place where one, you're not really thinking about the privacy you already have. And two, you may be thinking that you're a little more protected in society than you are. And it's not just you. Privacy is a team sport, right? So you don't have to think about, well, okay, the cops aren't going to come and pick up me. You should think about, are we worried about anybody in your contacts list? Anybody who you communicate with, anybody who you love, who's in your family. And again, increasingly these days, it's an easier argument for me to make in ways that are increasingly distressing. Right. Because if you don't know anybody with a green card and you don't know anybody who doesn't have papers and you don't know anybody who's an immigrant or looks like they might be an immigrant, I guess because the Supreme Court said it's okay to stop those people now, like the circle of people who say that the lack of privacy would never impact them is getting smaller and smaller. And I'm not happy about this, but it does make my pitch a little easier that people should care about privacy.

Yeah. I mean, you know, they were already there when I met them. But you know, the three founders of EFF: John Perry Barlow, who had a side gig as a lyricist for the Grateful Dead. I believe he called himself the junior varsity lyricist of the Grateful Dead. You know, John Gilmore, who really is the heart of the privacy push, and Mitch Kapor, who founded Lotus. If you're old school, if you've used a modern spreadsheet, you can thank or blame Mitch. But because they all came out of that, and they were—I mean, they got together because they were hearing about Secret Service raids on people who were doing early things with early internet technology called bulletin boards, where people were starting to talk to each other. This is before the World Wide Web, and the Secret Service was doing, and other government agencies were doing raids on these people and pulling all of their computers out. And it became clear to the three founders of EFF that law enforcement didn't understand what was going on. They were being manipulated. One of the early big raids was because AT&T claimed that a secret document had been stolen, and it turned out it was not secret at all. But they started thinking about what it was going to be like when the rest of us had access to this technology that relatively few people did. And what we were going to need to build into this digital world in order to make it kind of stand with the users and not turn into a police state and maybe not turn into a shopping mall. I'm not sure how successful we were on that one. And be a place that could actually handle kind of a political space, a space where people could organize and plan and meet together. And I mean, they were really prescient. They identified a few things that were really important. One of them was the need for privacy and a particular technology called encryption, which I'm happy to talk about a little more. That facilitates privacy, and also the need for the internet to be a place where the First Amendment applied, free speech. And those were two of the very first biggest fights. And I was the lead person handling the privacy one.

I was an outside lawyer at a little law firm. And the case was called Bernstein versus the Department of Justice. And we challenged the government's regulations on the export of encryption, which were having the effect of making sure that nobody on the internet could have a private conversation, could have access to the technologies that we need for privacy and security. It turns out, kind of magically, the same technology gives us privacy and security, both of which we still need more of, but we have a lot more of than we would have if we hadn't won this fight. So I got a call from John Gilmore, who I had met at a party at my house in the Haight, and he said, we've got this guy. He's a math PhD student at UC Berkeley. He's written a computer program, and he wants to publish it on the internet. And if he does, he will go to jail as an arms dealer. And I said, well, what does it do? Does it blow things up? And he said, no, it keeps things secret. Will you take the case? And I said, yes, because I wanted him to think I was cool and because I thought it was a fascinating question, like this idea that publishing something that was designed to help do a scientific conversation, but also was a way for people to keep things secret, that the government would put somebody in jail for. That seemed outrageous to me. And so we began to put this case together. It ended up being a First Amendment case, not really a Fourth Amendment case or other privacy case, because it was about his ability to publish his ideas. But it ended up freeing up encryption technology. And that's why we have it. And, you know, whether you use Signal or whether you're just navigating to your bank and, you know, you type in their bank address and you feel confident that you actually went to your bank rather than to someplace that got hijacked in between. There's a lot of encryption that happens under the hood of the internet now that helps keep us pretty secure and safe. And all sorts of other places. You lose your phone, you know, if you have to put a passcode into your phone to open it up, that's because it's encrypted, so that if you lose your phone, you don't lose everything that your phone is connected to. That's because both Apple and Google put encryption in your phone that kicks in and protects you.

No. Oh, okay. I'm not. Yeah. No. The program that we fought about was called Snuffle. And if you're a bit of a geek, I can get into what it does. It takes a hash function and turns it into an encryptor. So there's actually a technical point being made, by the way, this thing works, that this one thing, a hash function creator that is legal, became illegal with like one page of code. So what Dan was doing, Dan Bernstein, my client, was trying to make a technical point with what he was doing. But no, there was a whole other program called Pretty Good Privacy that lots of people were using to try to help keep things protected. And the guy who wrote that, a guy named Phil Zimmermann, who was from Boulder, Colorado, was actually under a federal investigation for having created the program when we launched our case. So ultimately, that case went away as the government started backing away from it. But it was really terrifying, and it was terrifying for people who were trying to develop this internet. It was terrifying to a whole sector of science, mathematicians and scientists as well. I mean, cryptography is a thing that you and I like to use, but it's also actually a pretty old kind of applied math. Right? Caesar had a cipher. Jefferson, our founding fathers. Yes. Ciphers were intrinsic. Yeah. So it's both a kind of a scientific thing. It's a historical thing. It has all of these precursors that we made sure that our judge here in the Northern District of California court knew about when we put the case forward. The case, though, the government dragged its feet. The case took over a decade to come to fruition.

It did. It did. Yeah. No, they were slow to, and in fact, they did a bunch of tricks along the way. They had it regulated under the State Department. They moved to the Commerce Department and like made us start all over again with a whole new set of regs at one point in time. And yeah, it was hard fought. It was hard fought. They thought they were standing up for the national security of the United States. And we kind of came in and we were standing up for the future, and there was a real thing that the judge had to weigh. I mean, you know, judges do not look askance at the federal government when they say the national security of the United States is at risk if you rule against us. That's intimidating. And we really had to point out that that wasn't really true. Given that we didn't, you know, Americans weren't the only people who could do math. So it turns out that the Germans and the Israelis and the Japanese had really good encryption too. So keeping Americans from participating and having the benefits of encryption wasn't likely to really actually give us the kind of edge that was kind of inherent in this argument. And we brought in, you know, we brought in a lot of scientists and mathematicians and computer scientists to try to explain about the internet, this new internet that wasn't even, you know, this is, again, most of this stuff was before the World Wide Web. So I was trying to talk to a judge who had never experienced any of this stuff about what the future was going to be like and why it was important for us to have this tool in it. And lo and behold, she agreed with us, which felt pretty magical at the time.

Yeah, yeah, the door is Room 641A, not very far from here. There's some street. I don't know which direction. Folsom Street, the AT&T building on Folsom Street. That's where Mark worked. And it is the door to the room where the mass spying on Americans was implemented after 9/11. So after 9/11, we started hearing from our friends in industry. We're a tech organization, we know a lot of people in various industries. And they would come to us and they'd say, we can't tell you what's going on, but it's massive. And you would be really upset if you knew. And we were like, well, give us averages. And they're like, we can't, we can't. It's classified or we'll get in trouble. We can't do it. But it's really massive. And so we were trying to figure out how we could get enough evidence because unlike some other situations, you really can't go into federal court and ask for relief based on rumors somebody told you at a bar one night. And so we were looking for evidence. And in late December of 2005, the New York Times ran a story that said Bush is spying on Americans in America. And that was the first big... There were other hints and small things, but that was the first big public awareness that there was some kind of spying on Americans in America happening with the NSA. And about three weeks later, we were in our offices on Shotwell Street then, and a guy knocks on the front door and he's in a trench coat and hat, and he has this raspy voice, this very—he's from Long Island, I believe, a very New York accent. And he said, I can't do the accent. He said, do you people care about privacy? And my boss at the time, Sherry Steele, had opened the door and she said, why, yes, we do. And he said, I work at the AT&T building down on Folsom Street in San Francisco. He had recently retired, and I think I hooked up the technology that lets them do what The New York Times is talking about. And he had a packet of information that he had basically walked out of his employer with when he was employed, because he thought something was weird, but he didn't know what, and he handed it to us and he said, I hooked up a set of splitter cabinets, the fiber, you know, for our communications carried on fiber optic cables. Fiber optic is light, right? Splitter cabinet splits the light. It's a set of little technologies that split the light. And the cool thing about light is that when you split it in half, you don't get halves. You get a full copy of everything that's carried on the light. And so he installed a bank of splitters right outside of Room 641A, and one set of the communications would go on their way to their recipient, and another set would go into this room. And he's like, why did they have me do that? Like, AT&T is not supposed to be doing anything with people's communications except delivering them. And then after the New York Times story came out, he put two and two together and said, I think that's what I did. And he showed up at our front door with the documents.

We get our share of people who legitimately believe that there's a chip in their head or something like that. And, you know, I'm not saying the government isn't doing that, but it's also often not true. But he had the schematics, and we sent them to some friends of ours who were in the telecommunications industry, and they did double check and they said, yeah, this is what it would look like. You know, we can't say for sure that's what they're doing because they weren't insiders. But they said, if I were going to do this, this is what I'd do. And one of them, a guy named Brian Reed, who's a big telecommunications guy, said, well, this doesn't look like a wiretap. This looks like a copy of everything. That's a terrifying phrase. It's still going on. You know, we did not succeed. We scaled it back, but we did not succeed.

Yeah, yeah. My colleague Kevin Bankston was just a brilliant person, and we had him thinking hard about what we could do about the post-9/11 surveillance. And so he actually, after The New York Times story came out and before Mark Klein showed up at our door, Kevin actually showed up at my house in Noe Valley on New Year's Eve, and he had a bottle of champagne in one hand, and he knocked on the door and I said, hi, Kevin. And he said, I want to sue AT&T. And I said, sure. I said, yeah, you're it. He said, let's... I said, well, come on in. But yeah, I mean, one of the things that Kevin realized, that was a key insight, is that the phone companies all have statutes that say they have to just make your calls. They can do things to protect their network. But other than that, they have to place your calls and protect their networks, and that's all they can do with your calls. Hands off the rest. They can't do the rest. And so that's a very clear duty. Unlike the Wiretap Act and the U.S. Constitution, which I think should protect you as well, but honestly have a lot more hurdles to go through. So we thought, well, this is a cleaner way to get at the problem and we should do it. And then, you know, lo and behold, a couple weeks later, Mark shows up at our front door and hands us the schematics. I mean, it was kind of crazy the way it all came down. And then less than two weeks later, we were on file with our lawsuit.

Absolutely, absolutely. And there, you know, there's this moment right where you're like, oh my God, you know, I had this little voice in my head that said, maybe I'm crazy, you know, maybe this isn't true. And then you look at it and it's true. And that happened quite a bit with Mark. It happened even more, whatever, seven years later, when Ed Snowden showed up. Yeah. Because we had the government saying we were, you know, we were a little cuckoo. We didn't know what you're talking about. They would neither confirm nor deny what was going on. But underneath that confirm or deny was these people don't know what they're talking about. They're just, you know, crazy, wild-eyed activists. And we knew we were right and we believed Mark, but we couldn't get anybody from AT&T, anybody else from AT&T to come and confirm what he said. So when seven years later, Snowden shows up with such incontrovertible evidence that what we were saying was right, that the Obama administration actually admitted it, that was the big relief. Well, we were like, wow, we weren't just tilting at windmills again. I didn't think we were. But you can't not have that little voice in your head. And having Snowden show up and say everything they're saying is correct was really both horrible. Right? You don't want to be right about this. Yeah. But also really, really justifying. It really felt good.

Well, you know, it kind of goes with the territory when you're a civil liberties lawyer in a little organization. But I do have always felt that it was a little gendered. Right. And this was not the experience that some of the other guys who went to law school with me who went into public interest would have. And it's this, you know, it's one of the things that, you know, one of my first bosses kind of taught me how to jujitsu this moment. Because I'd get on the call with opposing counsel, and they would kind of proceed to try to tell me how wrong I was about the case. But in doing so, they would end up laying out their theory of the case. Right? Why they thought they would win. But of course, the flip side of that is that actually gave me a roadmap for—and I do not take credit for this. It was my first boss, Bill Bald, who was the one who was like, you know, you should flip this around. They're telling you stuff that you otherwise would have to figure out over time in a case. They're giving you their strategy.

I'm just making notes. And I started fighting back at first because I'm kind of feisty. And then after a while, I learned to just sit down and shut up and take notes. And then I had a roadmap to what they thought was important. It's interesting because I tell the story in the book in the context of the government lawyer who I had in the Bernstein case, and then I ended up having as my opposing counsel in the NSA spying cases as well, a guy named Tony Capolino.

He's a prince. In fact, we're doing a five-part podcast series about the book.

And I'm talking to a bunch of people, and I got to spend an hour talking to Tony. He is now retired from the Justice Department, and we went back through like what it was like on his side.

Huge. And one of the things he said, he's like, I really am sorry that I came off as condescending to you. And he's like, I kind of went back and it made me think about how I came off. And he said, you know, I really, he said, I was intimidated by you. And that just blew my mind. Like, you never know how. You know, my reality is still my reality, but it is not the reality. Right. And, you know, he might just be being kind because I did beat him, but I don't think so. He's a really nice person. And it's something I just think it's really important to lift up at this moment, because there was a time when, even though we fought with the Justice Department, even though they were wrong, even though I think they took positions that were somewhat outrageous, like it was a, you know, they understood the idea of a loyal opposition. They understood that it was our job to come forward and try to test what they were doing. And again, I definitely am critical about some of the tactics and strategies that they do there. But there was a base level of respect for the process that is not seen as much anymore. And has deteriorated a lot. And Tony's retired. Now, most of the people who are my opposing counsel now have left the Justice Department, and I think they are very sad at the loss of the kind of professionalism and respect that they presented in presenting the government's case. And I just, I think it's, you know, it feels a little nostalgic now because it was a knock-down, drag-out fight, right? We did not agree. We still don't agree, even in the podcast. We don't agree. He will say now that he thought that he was absolutely right on the law, but they were wrong in history, and that he was trying to... interesting. Yeah. That basically, yeah, I mean, I see where he does a good job in the podcast listing on it. But like that the world needed encryption, that we were right, that the world needed encryption, but that he was right, that the law, the government's position was legal and whatever. Okay. But I don't know that you would get that from today's Justice Department in a law that they would say anything other than the game was rigged because they lost. Right. And that's a loss for the country.

Yeah. So Section 230 is, well, it's the bête noire of a lot of people on the left and the right now. But it is a very simple law. It says that a platform or a host of speech isn't responsible for the speech unless they're very directly involved in it. It's their speech that's different. But it's, you know, lawyers call this secondary liability, right? It's not liability for the speaker. It's liability for the people who are helping the speech happen, one way or another. Usually we're talking about platforms or Wikipedia or the Internet Archive. Lots of things that you don't think about. And so that's what it is. It's again, it's a lawyer, we call it secondary liability. But that's all it is. And the argument people who are upset at Big Tech have been told that the reason that Big Tech sucks is because they're not liable for what anybody says on the thing. Now, I want to be clear, just civil liability. Like they're still criminally liable. It's only civil liability. And it doesn't count for IP claims and copyright or trademark. And they have a whole other not very great system. But Section 230 is just about lawsuits, civil lawsuits, for something that a speaker says. And, you know, from our perspective, if you think about how the internet works, nobody doesn't need other people in order to speak. Like, I mean, maybe I think back in the day, John Gilmore had his own server and his own ISP and maybe his own root server. Right. But if you think about how the internet is, there's always, we all need other entities to be able to speak online. And if you make those entities liable every time somebody is upset at something that gets said, they're not going to host speech anymore, and we're going to be back in the day where only people, you know, it used to be the day that, you know, that if you wanted to speak to the world, you had to have enough money to buy a printing press. And now you'd have to have enough money to pay for damages for anybody who you let speak who says anything that somebody else doesn't want, doesn't like. That means there's going to be less ability for everybody to speak online. And that might be okay for some cases, but it's not going to only happen to the people you hate. It's not, right? And it will come. And right now, when you talk about 230, there is, you know, there's this conversation in DC about how opposition to reining in 230 is bipartisan. Well, it's bipartisan because the things that the Republicans think are harmful and need to go off the internet are completely different from the things that the Democrats think are harmful, but they all think there's harmful stuff that has to come off the internet. But like, if you pass this law, Marsha Blackburn, who's one of the big senators in the promoters in the Senate, she's talking about kids get harmed because they have access to trans information. And your t-shirt, I love the matching pink ones. This is the trans one. That LGBTQ content, the same people who are taking books out of our libraries and getting rid of the trans story hours, drag queen story hours, are the ones who are really psyched on the Republican side for 230 kind of liability because they want to make sure that Facebook and Google and Wikipedia and the archive and any other hosts can't host things that they don't want people to see. And the Democrats, of course, are worried about a whole other set of things. But you have to look a little closer at why this is bipartisan. And I really worry because at the end of the day, one of the things I think the internet was really great for was it gave a voice to people who couldn't buy a printing press. Right? It gave voice to people who weren't like the five executives in Manhattan who decided what went on broadcast TV. And I think that it's probably more than five, but it's certainly not the numbers of people who get to speak their mind today. And again, if you think that getting rid of 230 is only going to get rid of the speech that you don't like, you're not paying close enough attention to who else wants 230 reined in. And we've already had a couple of examples of this, right? We passed this law called FOSTA-SESTA that started off kind of on the left with the idea that there was sex trafficking information happening on the internet through some things like Backpage, which was a place where you could do adult ads and things like that. And by the time that thing got through the law, first of all, it wasn't just about sex trafficking. It was about any sexual content, including like legal, legal sexual speech. And it didn't stop the sex trafficking problem. But there is a hole in 230 right now for anything that is about sex, prostitution or sex trafficking. And I don't think it's made a dent in the thing that they wanted it to make a dent in. But it has meant that a lot of people who used to be able to have online, you know, ply their wares online, are back on the street.

And, you know, in my neighborhood where a lot of them, and, you know, I think it's not safe for sex workers. Yeah. On the street, it's a lot safer if they're not. And so I feel like we blew a hole in Section 230 in order to do a thing. We saw the process move from something that the Democrats could support to something that was really much more about the Republican anti-sex agenda, and we didn't solve the underlying problem. So, I mean, are we going to do that again?