Who Defends Your Digital Rights? Meet EFF's Cindy Cohn

We need strong security and privacy. And it's not just because of law enforcement access. I mean, that's how bad guys get into our, you know, if the if the police showed up at your front door and said, "Guy, you know, we're really worried there's a lot of break-ins in the neighborhood. So, what we want you to do is to leave your back door open so that if the, you know, if the if the burglars break in, we can catch them easily because we don't want to have to bound down your front door in order to do it." Like, you'd look at them and tell them they were crazy. Um, but when that's happening in the context of digital devices where it's a little more abstract and they use language to obscure what they're doing, like this gets put forward as if it's like, oh, law enforcement absolutely needs this. This it's crazy and it's it's bad for all of us.

Well, you know, I kind of fell into it to be honest. You know, um, you got to remember 1989, 1990 to 1994, there was no worldwide web. you know technology was you know being done mainly by you know uh people who had high technical skills out of universities and research institutions and I happened to meet some of them um and one of them was EFF's founder John Gilmore and I literally met him at a party in Haight-Ashbury um and we became friends and I I for a while I dated one of his friends and he was you know putting EFF together the electronic frontier foundation So, a couple years later, um he called me up and he said, "Um, do you know how to do a lawsuit?" And I, you know, just a couple years out of law school, really not the right person for this, said, "Sure, I know how to do a lawsuit." He said, "Good, cuz we we've got this guy and he wrote a computer program and he wants to publish it on the internet and he's been told that if he does, he could go to jail as an arms dealer." And I said, "Well, what does it do? does it blow things up? And he said, "No, it keeps things secret." And I said, "Well, that sounds like a problem and a First Amendment problem um at that." And he said, "I think so, too. Will you take the case?" And I said, "Yes." I had never been online. I didn't really know very much about what these guys were doing. I mean, they were my friends, but um and I I I wasn't even that, as I you know, as you pointed out, I'm kind of a baby lawyer, right? I'd never done a constitutional case that, you know, of that magnitude. Um but I got lucky and you know between John and some of the ear other early uh internet people and then very kind people like cryptographers and and computer science professors you know Hal Abelson at MIT and and a bunch of others they actually taught me enough about you know how the internet works how coding works and how cryptography works that we were able to mount this challenge um and do so successfully. But I, you know, to me it's I just was in the right place at the right time. Uh, and and had the, you know, the kind of the good fortune to think my friends would think I was cool if I did this lawsuit. Um, and and and then the patience and support of a lot of people to be able to kind of sit at the, you know, I always call it driving the big truck, right? To be able to sit in the driver's seat of this big truck that we drove through the government's cryptography regulations.

Totally. Absolutely. Now, I mean, I had the good sense and the luck to have a lot of people around me who and and to be able to pull in people, you know, by the time we got to, you know, uh, pretty deep, you know, deep enough in the case, you know, we had a guy named Bob Corn-Revere join our case. he'd already argued a first amendment case in the Supreme Court. Um, and he saw what we were doing and came in and, you know, was like, let me, you know, let let me make, you know, let me help ground you in this kind of long history of the Constitution. So, you know, I it's more like we were kind of this rolling tumbleweed that started with just me, but as we went along, we we picked up people with expertise and support so that by the time, you know, I was standing in front of the Ninth Circuit Court of Appeal arguing this case, I I was standing on the shoulders of of lots and lots of giants who had thrown in to to help us. So, um but yeah, the very start of it, it was quite literally, you know, um I thought my friend John would think I was cool if I said yes.

Oh, as a as an Iowan, uh, you could give me no higher compliment than comparing me to Caitlin Clark. Yeah, she she's she's from my home state.

No, no, no. My um sadly uh um not sadly, I don't want to be related to him, but uh but yeah, my my family doesn't come from uh from that. I was, you know, that neither of my parents went to college. Um and and I was lucky enough to get to go. I would not brag about being related to Roy Cohn. No, I do not want to be related to him, but I I did not come from uh kind of highly educated, lawyered up uh family.

Well, I think that what would be different today is that we'd have even less security online than we do now. Now, we still have a lot to do. I don't claim that, you know, this is an ongoing fight and the attacks on encryption keep coming. Um, the UK is horrible right now. Australia passed a bad law, but we have Signal. We have we have, you know, HTTPS, right? The, you know, the ability to go from your browser to a website without that information being in the clear. So, you can access information without it being immediately tracked. Uh, we have, you know, basic security, right? When you turn off your phone, it's encrypted. So if you lose your phone, you don't lose access lose all your data or access to all your data. That's because Apple put um encryption into the the actual device so that your data is encrypted when you turn the when you turn the device off. The same thing's true for for for most um computers and phones now. Um you know, encryption is really baked into so many things we do. And it would either I I think it would be not baked into nearly as many. I think the government would have ultimately had to let us have some security online. Um, but it it wouldn't have been nearly as as pervasive and we wouldn't be able to continue to deploy it without government approval. And you know, governments um you know, parts of governments are really understand the need for strong security. I would say NIST and some of the other um parts of government, but when you get over on the law enforcement side, they're really really hostile to it. And that fight, we've had an upper hand in that fight since the '90s because this wasn't a regulated uh you know, this wasn't it got taken off the munitions list and it wasn't regulated. So, we could go ahead and innovate first and and not not have to go to the government on bended knee and beg for permission. Um, and I think that's benefited all of us in terms of even having the security we have now online.

Yes. So, the government I mean it's hard because the UK has even more secrecy around these things than we have in the US. So, we don't know exactly what's going on. What we know is that Apple offered something called um I think it's called ADP, advanced data protection uh or might be a I might have that wrong. Um, but basically you could turn on a switch and have advanced protection and that would mean that your iCloud backups were encrypted. Now, we think that should be the default and not a switch you have to turn on, but that's okay. At least they offered it and that's really important for human rights defenders, for journalists, for people who find themselves targeted um by, you know, for espionage um as well as as by governments. Um, and we know that the UK government um h has demanded that anybody who provides you with a service or a device have access to the plain text of everything you do on your device. Um, and and this is the way they talk about they don't say, "We're going to ban encryption." They always say, "Oh, we love encryption. We're not banning it, but we're just going to make sure that the people who provide you with services and devices always have access to the plain text." And there's there's no way to read that as anything other than denying you encryption, right? real encryption. And um so we know that the the UK government provided something to Apple. We think it's that they had to provide access to the plain text and that Apple responded by um or re-engineer the device so that they could always have access to the plain text. And we know that what Apple did in response is say, well, we're just not going to let anybody turn on this extra protection in the UK. Um because I think they didn't want to have to downgrade it. It's pretty hard to downgrade it just for uh UK people. And it of course if they downgrade it for people in the UK, that's anybody who's talking to anybody in the UK. So that infects all of us um or most of us. Um so we think that's what's going on. We haven't seen the actual documents yet, but but I think it's a safe bet that that's that's what's going on with Apple. And you know the thing that's I mean you know I really appreciate Apple because they've been pretty public about it as public as they can be. We don't know what kind of orders have been issued to the other companies who have been very quiet, but I think it's highly unlikely that the UK government just picked Apple. Um, they're not even the biggest operating system, right? The Android is bigger when you go global. So, I I suspect that something similar could be going on to Android and other and other devices that that we just we're just not it's not as visible to us. I again, I don't know. It's all secret, but um I think in time we're going to figure it out and and it's problematic. people should be rising up like we need we need strong security and privacy and it's not just because of law enforcement access. I mean that's how bad guys get into our you know if the if the police showed up at your front door and said guy you know we're really worried there's a lot of breakins in the neighborhood. So what we want you to do is to leave your back door open so that if the you know if the if the burglars break in we could catch them easily because we don't want to have to bound down your front door in order to do it. Like you'd look at them and tell them they were crazy. Um, but when that's happening in the context of digital devices where it's a little more abstract and they use language to obscure what they're doing, like this gets put forward as if it's like, oh, law enforcement absolutely needs this. This it's crazy and it's it's bad for all of us.

That's correct. And and and even if you think, well, the UK, you know, they're a western democracy. They have rule of law and they have due process. It's not just the US that's going to be following. It's all the countries of the world, right? Like you're going to have Nigeria, which has a tremendous, you know, problem with corruption in their government and attacking political opponents. You're going to have, you know, all all of the countries in the world are going to say, "Well, you did it for the UK. you should do it for us." And I I think it's terrible in the United States. It gets even scarier as you go around the world.

No, no, no. I mean, it is a time to be scared.

Yep. The Electronic Frontier Foundation is the oldest and the biggest online digital rights organization. We have uh we're based in San Francisco. We're now 125 people strong. Um and you know, essentially we work to make sure that when you go online, your rights go with you. Um so we are civil liberties organization. We're focused on law and rights as they relate to digital technologies and and we really center ourselves on the users of technology. So making sure that the users of technologies are have a voice and are protected as we're we're moving forward. Now, our tools are we're a lot of lawyers. I think that's still my biggest team. We do impact litigation. So, we take cases like my Bernstein case to try to set the law, especially constitutional law because that's the province of the courts in the right place to protect users. Um, but we also have an activism team. And we have a tech team. Uh, we call them the PIT crew, the public interest technology team. Um, and we build some technologies. So, we build a a Firefox. Uh we build a a plugin for uh Firefox and Chrome called Privacy Badger that blocks tracking cookies, those cookies that follow you all around the web and do and blocks other kinds of tracking. We build a thing called Certbot, which is part of the process for certificate authorities for making sure that when you go to visit a website, your your traffic to that website is um not trackable because it's encrypted. Um so we we build technologies, we bring lawsuits, we do activism. Um all of these kind of towards this goal of trying to make sure that that your rights are respected uh when you're using technologies.

We are member supported. EFF has um you know we get no government money. Um we get um a little bit of foundation money. We get a little bit of corporate money, but not from the big guys. Um, that often comes with too many strings about our advocacy. So, companies that that are a little smaller and that might be running a VPN service or a privacy service, we get we get some support from them, but mainly it's individuals. Um it's you know over half of our money comes from individuals and and a huge chunk of that come from people who who are ordinary members who you know who who give us 60 bucks or 100 bucks or a thousand bucks and get t-shirts and hats and stuff. Um I think you know EFF has been kind of a a marker for people that they you know that they love tech but they also love rights that they're they're trying not to use tech to to to crunch on people. And you know, we have a pretty good membership inside the big tech companies, the Facebooks and the Googles and the or Alphabets and the and other companies. Even inside the government, we have a lot of members because I think it's a it's a way for people to kind of show that they're they're trying to be in this for the for the right reasons and that they really want to build and support tools that that support people rather than oppress people. So, um we're we're member supported and um and always have been.

Correct. Only we have much cooler t-shirts, hats, and stickers. Uh but yeah, it's a lot like that. I, you know, I kind of joke sometimes at EFF we work for tips, right? Um you know, we're going to go out there and do what we're going to do. And if people think that what we're doing is important and it's important to have kind of a foothold and a voice out there to to counterbalance either the strong the governmental voices or the the corporate voices that might, you know, be enshittifying your tools or not really on your side. Um we're we're one of those people who show up and try to fight for it. And and I think the thing that makes us there's a lot of digital rights groups now and I really love when I got into this there was just us and now there is a whole constellation of people doing really good work. I think what makes us different is that we do have this tech team. We're really grounded in how the tech actually works. We're we we don't fly off and and and um kind of pretend, you know, or tell the scary stories about how, you know, tech's going to eat your children or any of those things. We're really try to stay very grounded in how things actually work. and and we've developed a reputation in the courts and in Congress and in in various administrations going all the way back to the 90s as the people who show up and will tell you the truth about how technology works and how it doesn't work.

It's probably no. And this has actually happened. Some of those people uh not ones you've met, but some of those companies have offered us um a lot of money. Um and you know, historically in the past, there was a time when we were kind of more aligned with them, especially the early days with Google. we were pretty aligned with them because they were they were um trying to free things up especially in in some of the copyright fights that we've done and IP fights where they were really trying to give users access to information and stuff. Um but you know those days are kind of gone. There is a different leadership and and they're much bigger and they have a different viewpoint. So um but you know right now if one of those companies showed up and said you know let us shower you with money like I would take the call. Um, but if there were any strings attached, if there was anything that that that made it look like it, and honestly, for some of them, I think at this point, I I probably would just say no because there's no way it wouldn't be perceived that way. The answer is no. I I really want our support to be who the people we are who we're standing up for. And I'm not in this to stand up for Jeff Bezos. I'm not in this to stand up for Mark Zuckerberg. I'm in this to stand up for all the people who are, you know, in some ways kind of feel like they're hostages to these people, right? Um, and you can't can't really do both, right? You can't stand up for the the people who are locking you in with a surveillance business model that tracks everything you do and ranks you and the people who are being tracked. You kind of have to be on one side or the other. Um, at this point in time, I'm sad about that. Those companies used to side with their users a lot more. And one of the sad things that I've seen in the 35 years that the organization has been in existence is is the sliding away from those kind of tech and user roots towards a more adversarial position towards their users.

Tried to be a little kind, but yeah. No, and I think it's problematic, right? Because I worry, you know, it used to be people came to Silicon Valley because they had a cool idea that they really wanted to make happen. You know, I even, you know, I know he was a difficult guy, but even Steve Jobs, like he was a problem solver, right? He was trying to make um trying to solve interesting problems that would help people. Um, and again, I don't didn't know the man. I don't claim to know everything. Now, it just seems like it's like how do we exploit people's data to make as much money as possible? And that's a very different framing than than what I lived through in the '90s and the 2000s from the from the outside looking in because I'm not inside the tech bro community.

And I I just it's so it's it's so disheartening, right? Because again, I was in the Silicon Valley in the '90s and the 2000s and and you know, I know there was another vision. I know that there was another thing that a lot of people were doing. And I I you know, the the good news is there are people doing that now. We're seeing with decentralization with you know, Signal exists. It's strong. is powerful. It's so powerful that you know the the people in the federal government use it when they shouldn't. There is it's just the rest of the internet is still there. It's just been completely overshadowed and underfunded because of the rise of these tech giants and their you know capitalism surveillance capitalism business model. But if you kind of if you peel it back you can still find people with those ideals and and those visions. And if you look in Mastodon in the decentralization space or if you look in uh in all sorts of Wikipedia is still here. It still exists. It's under threat right now. But like those places still exist. They're just all the air gets sucked out of the room by the tech giants. And and some of what we try to do is to point out that you know the internet isn't Facebook. There's a whole set of other things that aren't in the tech giants. And if we turn our attention towards them, there are people there who would who could use a little support and coding and lifting up to to build a a better version of the of our world.

I mean, I think it's hard to be alive in America right now and not be worried about authoritarianism. I I think that's the scariest thing. The scariest thing is we've got through, you know, we're seeing the takeover of both the, you know, our business side and our civil liberties side by a, you know, um, an idea that one guy gets to make all the rules for all of us and that there's no there's no questioning that this this kind of, you know, king-like mentality. Um, I think unless we fix that, we can't even get at most of the other problems. And we're seeing it in, you know, kind of rule by executive order. I mean, executive orders have always existed, but they weren't the law of the land. Um, and they shouldn't be, right? We're supposed to have checks and balances and due process. Um, and you know, for me as a civil liberties lawyer, these are our tools, right? like we need we need tools to go into court or to go to have a Congress that's actually willing to to to pass a law that protects us as opposed to just you know doing the bidding of one guy. Um, I think until we get past the, you know, kind of rule of kings mentality, we it's it's hard to to deal with any of the other problems. And that to me is the scariest thing that's going on right now is watching these institutions that, you know, we need in order to protect us kind of not step up to the moment and do it.

Okay. Yeah.

Well, it depends on the conversation. Um, I I usually I try to set it for a week, but if it's something where we're planning something over a longer time, I will sometimes keep it um longer than that. Um, but I'm uh, you know, I have occasionally used Signal to kind of develop an expert witness in a case or something like that. And then I keep them longer because I want to be able to go back and make sure that, you know, I'm I'm, you know, my memory isn't so great. But, um, and, you know, different things have different needs. So,

Well, it depends on the situation. So, you know, if something isn't privileged and is uh is evidence in a case, then you have to turn it off, right? just like if anything else, if you've got auto um deletion of your email or anything else, I mean, the the law requires that if something is at issue in a case, then you can't get rid of it. But I I don't think you should live your life as if you're always under an order from, you know, under a privilege hold, a litigation hold. Um because I think that that that can end up being its own problem on its own side. So you you know certainly if something is looking like it's going to be evidence in a case um that's actually pending or threatened um then yes you should put a litigation hold in place and you should not get rid of it. But I I think that it's still better in the rest of your life which shouldn't be all your life uh to only keep things for as long as you need them and get rid of them. And this is our advice to companies too, right? you know uh you know people shouldn't be just gathering up data and keeping it in case it might be helpful someday that that way lies a lot of problems um and it's better you know I used to joke it that EFF that we we had become an anti-logging society right uh that we uh not in terms of trees but in terms of your logs that you should really think hard about what you're logging and why um because it can end up being a vector and as people who've been through litigation know it's really really expensive if you've kept everything all the time and you have to turn it over in litigation, whether it's even remotely useful or not, because sorting through what might be relevant to a litigation hold and what isn't, is its own huge burden. So, you may not be saving yourself money or hassle or time in the long run by defaulting to keeping everything.

Did something happen to you, Guy? What happened?