Thank you. And we'll have some opportunity to talk to everybody. Thank you so much. Thank you to Scale for inviting me. This is my first time at Scale. I'm so excited. You know, EFF and the open source community — it's a long-term relationship we're in, friends. And it's really great to see people show up. This is a really fabulous conference. We come every year and every year our team comes back and they're like, 'Scale was amazing,' and I'm like, 'I get to go this year.' So thank you all, and thank you for showing up on a Saturday morning.
I am the executive director of the EFF. I have been with the organization for now 26 years formally, and a few years before that. Thank you. I'm going to be stepping down because it's time to pass the torch, probably sometime over this summer. But don't worry — they made this shirt for me, you know, 'Let's sue the government,' and I'm not done suing the government. But I think it's time, for the health of the organization, to let somebody else lead. On my way out the door, though, I have written a book, and I was so excited to hear from Scale because the book comes out on Tuesday. So you guys are my first official stab at a book talk.
And I want to talk to you about — there are three stories in the book, and I want to focus today on one of them because I think it's really important for this community, the hacking community, to make sure that you know your history, but also think about how we can apply some of those lessons today. By the way, here's the book. I just got it this week. Thank you. Yeah. And I will be doing a little mini book tour, but you guys get the first look at, the first listen to some of the stories I tell in there.
And you know, I wanted to write a book for a couple of reasons. One is because I found that some of the history of the early internet is about like dudes and the companies they built. And not that that didn't happen, but those were incredibly rich times. And there were a lot of people who weren't, you know, named Jobs or Gates or things like that who were involved in the early internet. And I, with my silver hair, I see some of you in this room now. And I felt like it was an important part of our history to capture. And I also just feel like it's important in this particular time that we think about the ways that we've made change in the past and see if we can draw some inspiration from them.
The other thing — and I did this very intentionally — I'm calling all of you hackers. I think it's time, after 20 years, that we reclaim that name from the people who tried to make it about something illegal. In my world and where I came up, being a hacker meant somebody who hacked away at a problem until they solved it, like the way you take a small axe to a large tree. And in that spirit, I think some of the people who built the early internet, especially in the open source community, really did have to hack away like that. And again, I think it's time we reclaim that term. So I am very intentionally calling this community the hacking community. And if you don't like it, you can take it up with me afterwards. But my fight is not with you, it's with the people who tried to take something beautiful and make it something nasty.
So this is why I'm going to have this conversation, and I just want to put my cards on the table. I'm trying to recruit you. I work for an advocacy organization, and I'm an advocate, and I believe that we need all the hackers in the world to try to help us make the world a better place. So no secrets here. That's my job right now.
Now, my book is fundamentally about privacy and why privacy matters. And I feel like it's important to start by thinking about why we care about privacy. And I would submit to you that privacy isn't what you think. Privacy isn't a cloak of invisibility — that's our friend Harry Potter there — that you kind of throw over your head before you're about to do something you don't want anybody to know about. It definitely does that. It can do that. But that, to me, is not why privacy is important. Privacy is important because it is a check on power. It is a way that people with less power can have some protection against people who have more power and create space for themselves to live an open, free, and liberty-filled life.
And you could think about this kind of in spheres. Privacy is a check on power at every level. First, in personal power. EFF works with domestic violence victims who are trying to get out of the surveillance that their partners have put on them so that they can get out of a very dangerous situation. Privacy is a check on power literally in people's homes. It's a check on power on the corporate side. Right now, we're living in a time when corporate surveillance and the corporate business model is having real impacts on people's lives, including what prices you might pay, whether you can qualify for a mortgage, whether you can qualify for any of the things that you need in modern society. And we're starting to see that surveillance really be weaponized against users. And privacy is one of the ways that we can regain our power against the companies, large and small, who want to control us and manipulate us and empty our bank accounts as much as they can.
Privacy is a check on governmental power, and this is where I've spent most of my career working. It enables dissent. It enables the freedom to think for yourself and share ideas and plans. And I would submit to you that every single effort to try to bring more rights to more people in this country, while it had a public part, had a private part to start. And I want to give you an example. In my lifetime, we went from gay people being beaten up — literally violence against them — for talking about the idea that they should have equal rights, including the right to marry, to the US Supreme Court supporting that right. And the public parts of that work could not have happened unless there were private parts of that work.
And we see it right now. There's plenty of organizing happening around injustices that we're seeing in our country right now. And that organizing has to happen in private if it's going to get a leg up and get a chance to catch fire and do things like change who gets elected in the midterm elections. So privacy, I think, ultimately enables democracy. It's pretty easy to see. This is why we have a secret ballot in the United States, because if somebody could tell who you voted for, they could buy, sell, or coerce you into voting for who they wanted. And the fact that we have a little zone of privacy around our vote is why we have a free ability to vote for who we want and not vote for somebody based on pressure from powerful forces. So yes, privacy is great if you want to do something that maybe your mom doesn't know about, but it's more important because it helps protect our democracy. And that's why I've been involved in protecting privacy for the whole of my career.
So now I want to tell you a little story about something that happened in the 1990s that I think sets the stage for a lot of where we are today, or at least might be able to spark our imaginations. And this was the fight that I helped lead to free cryptography from governmental control. The case was called Bernstein versus Department of Justice. We filed it in 1994. So our fight to free cryptography predates the World Wide Web. And it came about in a very interesting way. I got a call one day from a hacker who I knew socially who asked me if I would be willing to take a case about a PhD math student who wanted to publish a piece of computer code on the internet and was told that if he did that he would go to jail as an arms dealer. And I said, 'Well, what does it do? Does it blow things up?' And he said, 'No, it keeps things secret.' And I said, 'Well, that sounds like a First Amendment problem to me.' And he said, 'Me too. Will you take the case?' And I said, 'Yes.'
But that wasn't just what happened, and that wasn't just the role that the hacking community played in freeing up cryptography. And if I may, I want to paint you a picture of one of the very first times that we went into federal court, which is the story that I open the book with. Cypherpunk dress-up day. As I rounded the corner from the elevator on the 19th floor of the federal building in San Francisco, I could see that the crew that gathered in front of Judge Marilyn Hall Patel's courtroom was definitely not your normal courthouse fare. Standing and even sitting on the majestic marble floors were well over 30 people, mostly pale white men in their 30s with long stringy hair. They were uniformly scruffy and awkwardly dressed in suits and ties. They all seemed to be in outfits that their mothers had picked out for them for a family wedding. Or maybe I was just projecting. I was 32 years old, worried about my hair, and wore a suit that my mother picked out for me from the Denver department store where she worked. They may have been a motley bunch, but they warmed my heart. They were there to show support for me as I argued a case called Bernstein versus Department of Justice. It may not have looked like it, but it was obvious to me and that crew gathered on a cool San Francisco morning in September 1996 that what happened in that courtroom would be crucial to the future of the internet. How Judge Patel ruled would play a major role in determining whether people would have privacy online.
So the hackers came and found me, but they also showed up and, at our request, dressed in their finest so that the judge could see that they were serious about making change and that they were serious that this was important. And it was important. I want to pause for a second and think about what the internet might have looked like if we hadn't been able to free up encryption. And believe me, I do not believe that the internet today is as secure or private as it needs to be. But let's do a little thought experiment about what it would be like if we hadn't had any encryption the way the government wanted it in the first place, or any encryption that they couldn't easily break — which, of course, means the bad guys can easily break it.
There would be no way to organize securely like we're seeing today with secure messaging like Signal and other tools. If your phone was stolen or seized, your entire identity and communications would be compromised. There would be no way to ensure that you were getting information from who you thought you were getting information from, and that your web browsing wasn't being hijacked and redirected, whether that was your bank or someone you're communicating with to build power. And you couldn't know for sure that you were actually communicating with the people you thought you were communicating with, because as we all know, man-in-the-middle attacks and other kinds of things can hijack those conversations. And apart from that, we would have things like regular old fraud and service interruption, and it would probably be impossible to have e-commerce without freeing up encryption. Ultimately, the internet could have remained a tool for the academics, governments, and the few hacker types who were using it in the early 1990s. Now, not everything about the massive use of the internet by all people all around the world is good. But I think we might not have even had that opportunity — the opportunity to make things better and fix it — had we not had encryption in the first place.
So, I've already given you a little bit of a story about the problem we were facing. In the 1990s, the government classified encryption software as a munition, which meant that on the big list of things that you can't export from the United States without a license was surface-to-air missiles, tanks, and software with the capability of maintaining secrecy. And export meant publishing something, putting something anywhere where a foreigner could have access to it, which means no publishing on the internet. And this wasn't just a theoretical threat. How many here have ever used PGP or tried to? Yeah. Well, the creator of PGP, a guy named Phil Zimmermann, made the first really widely available encryption product that could be used and was used by human rights activists and journalists all over the world for many years. We have better tools now. But you know, Phil Zimmermann faced a criminal investigation from the feds for writing this code and making it available to people around the world. So this just wasn't theoretical. And we had loads of lists of other people in academia and otherwise who faced government threats and resistance for making encryption software available on the internet.
So that was the problem that we were dealing with, and what we decided to do was use the First Amendment, because this was about publishing on the internet. And in the early 1990s, the question about whether the internet was going to be a place of free, full First Amendment protection or not wasn't yet answered. And we knew that freeing up encryption and freeing up the science of cryptography and the ability to share code was going to be key to making the internet itself a place of freedom of speech. So we put a case together under a legal doctrine called the prior restraint doctrine. I'll give you a tiny little bit of legal, but I'm not going to get too deep into it. Basically, this is a doctrine that says if you have to go to the government to get a license before you can speak, the government has to meet very, very high standards before this would be legal. Otherwise, the First Amendment forbids it. And when you have to go to a government agency and ask for a license before you can publish something on the internet, that's a prior restraint on speech. And so that was the argument that we made to the judges, all the way along.
But we weren't there alone. We had tons of support. We had, of course, the hackers who showed up with me in the courthouse that day, but we also had cryptographers, computer science professors, open-source toolmakers all submit declarations to the court about how important publishing cryptography and publishing in general on the internet was, along with privacy groups and civil society. But it wasn't just inside the court that we had support from the community. As I mentioned, it was a hacker — his name's John Gilmore — who called me and asked me to be the lawyer. But they also sat down with me and they taught me enough about this technology, enough about this new world, so that I could translate this out to a judge and several judges before the thing was over. They took the time to take somebody — I'm an English major lawyer — they took the time to sit down with me and explain to me how cryptography worked in a patient way and in a way that made me feel like I could be empowered to support them and the work that they were doing.
And I think this is a really important lesson for these times, because people are hungry for privacy and security, and the people in this room have the knowledge to help them. And I see all over the place just much more reaching out by people in the hacking community to try to invite people in, educate them, and help that. And in doing so, I think you're standing in the shoes and following in the legacy of some of those early hackers. And I really want to commend you for it. And they were active both inside the court and outside of the court. There were efforts in Congress. There were efforts to pull industry in, which normally doesn't really want to go up against the national security infrastructure of the United States, but many of them did, and they were pivotal. And then they were in the public, and they did all sorts of things, right? People put RSA code on T-shirts to demonstrate that this just wasn't a secret and you can walk around with it. I believe one guy got a tattoo of encryption code. I don't know, you might be in this room. And they did a lot of — you know, some stuff kind of — they published books, they did a lot of work to try to really make sure that the general public saw how silly it was to treat code as if it wasn't another means of communication — a special means of communication that's very, very good at telling you how to do things, but is no different than other means of communication.
And ultimately, they helped me develop some of the metaphors I used to try to explain this to our judge, who was not a technical person at all. But we used metaphors like recipes, right? A recipe tells you how to bake something. I think a good piece of code tells you how to do something in similar ways. And other sorts of ways to kind of translate out from the world into a place where first me as a lawyer and then ultimately the courts and members of Congress could understand what we were up to. They were deeply and directly involved.
And what happened? Well, we won. The judges, both in the district court and then later in the Ninth Circuit, held that code is speech. Thank you. And this precedent ultimately helps your right to innovate without government pre-approval and censorship, your right to publish security research, your right to build privacy-protecting tools and share them with others. And I think it opened the door to — well, I know it opened the door to a lot of the encryption that we have today, from tools like Signal to things like Certbot and Let's Encrypt and certificate authorities that let you navigate the internet using HTTPS and not HTTP. So we were successful, and it was kind of a glorious thing. And so I want to tell you how the story ends.
I mentioned a guy named Tony. Tony Falco was the name of the Department of Justice lawyer who I litigated against on the other side throughout this. And in 2000, the summer of 2000, I got a call from Tony and he invited me to come to Washington, DC to talk about the encryption regulation. So I got on an airplane with a couple of other people and we went to Washington, DC and we met in a room. So I'm going to read you a little bit about how it ended. The meeting was in one of those majestic DC buildings. I could smell the wood polish on the wainscoting. I always tense up when I'm stepping into the halls of power, and this one felt especially powerful. Portraits of generals and other senior military officials, mostly men, looked judgingly down on me from the walls on either side of the room. As always, the chairs were too big for me, just like the ones in the courthouse in San Francisco where this all began. While the setup was intimidating, the underlying truth was quite different. We'd come to negotiate the terms of the government's surrender. Part of me was elated at our victory. Another part of me was disbelieving. But it was true. Likely due to some combination of the court rulings, the mounting congressional action, and Silicon Valley corporate pressure, the government had decided to give in.
Once we had settled in and pulled out our notes and files, Tony, still in the shadows, started the meeting. He took a breath and we braced ourselves. But he didn't sound angry. 'I want to thank you for flying in from California to meet with us,' he said to me, his voice bemused and perhaps a little resigned. 'I guess for our purposes today, I am the prince of darkness.' I felt a smile kick at the corner of my mouth, and without really thinking, I quipped, 'I guess that makes me the princess of light.' Then we began. Tony had sent me a proposed set of revised export regulations for review. They dropped the onerous and uncertain requirements of pre-publication review for open-source and other publicly available encryption software that had been the basis for our procedural prior restraint claims. The new regulations replaced that process with a simple requirement that somebody exporting — that is, publishing — such encryption software merely send a link or a copy of the code to the government at the time of publication. It was 95% of what we wanted. We had a few suggestions and objections. The meeting lasted for about an hour. In the end, we didn't get much of our additional wish list, but we didn't really need to. The draft regulations were going to allow Dan Bernstein to publish his code, plus much, much more. The government was relinquishing nearly all of its grip on strong encryption and the science of cryptography. The benefits would reach Dan and other academics, of course, but would also reach deep into the public side of the internet, allowing companies and individuals to implement strong encryption into the tools and systems that the rest of us rely on. We had ensured that the tools that protect privacy and security online were legal and that the science they came from could continue.
So that's how that case ended. And it was a tremendous victory. Like all victories, we have had to continue to fight to protect it. And there were other efforts by the government to try to undermine encryption, as many of us learned later when Mr. Snowden came out with his revelations. But it was a big victory, and it cleared the space for what we have today. Now, it was a fun story, don't get me wrong. It's not really how change usually happens when you're up against the government. And the other two stories I tell in the book — one about the NSA spying and the other about national security letters, both about post-9/11 spying that the government did, some of it publicly known and some of it not until much later — had a pretty different trajectory.
The second set of stories are about the cases we brought against the NSA's mass spying, starting after the New York Times revealed in late 2005 that the government was spying on Americans on our home soil. The fight was pushed forward by a whistleblower named Mark Klein, who literally knocked on the front door at the Electronic Frontier Foundation in early 2006 with details about how the NSA was tapping into the internet's backbone at key junctures, including in a secret room in the AT&T building in downtown San Francisco. This is the most cloak-and-dagger of the stories I tell, made possible both by Mark's courage and that of Edward Snowden, who revealed even more about the NSA spying in 2013 because he was angry at watching the government lie repeatedly to the American people, including before Congress. As a result of our early victories, though, Congress rushed in to protect the phone companies, killing our first lawsuit.
Later, after the Snowden revelations, we were able to go back to Congress again, and lawmakers passed some reforms to the programs we had sought to stop, but not nearly enough. In the end, the Supreme Court supported the government's argument that even though the whole world knew about NSA spying and that we had evidence of exactly how it worked — or at least how it worked in early 2003 — and that it relied on collecting information from the major telecommunications companies, the knowledge about which telephone companies participated in the mass spying was such a secret that the case couldn't go forward. But by the time we got there, we had sued the government, had ended entirely one of the three programs we sued over, scaled back significantly the second one about phone records collection, and also scaled back significantly the scope of the mass telecommunications collection from the upstream program.
And the third story is about a set of cases that had a similar trajectory: an early win in the courts and some reform in Congress, but still not enough. And I call these the alphabet cases because we couldn't even name our clients for six years. And so we called them Case Q, Case Z, and Case X. And we brought those cases to try to scale back a kind of subpoena called a national security letter that the government was issuing to telecommunications and other service providers, demanding information about their customers and gagging the companies from ever telling anyone that anything had happened. Now, we were able to get those gags lifted over time, and we were able to get a lot more procedural protections and let companies give transparency reports that gave a general idea of how much they were being asked to do this, which, by the way, was a lot. There were hundreds of thousands of these issued that implicated millions of people in the times that we were able to track. But we didn't get nearly enough of what we wanted.
So our Bernstein case was amazing. It was fabulous, and we had support all the way along. Change usually happens a little more like what happened in the NSL and the NSA cases, through a thousand tiny cuts. But along the way, we had support from the hacking community as whistleblowers. Both Mark Klein and Ed Snowden are technical people. Mark would have called himself an engineer and not a hacker, but he's passed away now, so I get to say that I think he was a hacker in his heart. The media, public pressure, and people continuing to explain to the public how surveillance worked — because it's opaque, it's hard for people to see it, it's hard for people to understand it — and the hacking community has played a huge role in continuing to keep attention on...
these issues and continuing to talk about how important they are. And that pressure did lead to congressional reforms, increased pressure from courts, and some administrative shifts that we should all be proud of, even as there's more work to do. And by the way, as part of trying to show the problems with the NSA, we did fly a blimp over the NSA's headquarters in Utah where they were building a gigantic data center to hold all the records. And I don't know if you can read it, but it says illegal spying below. Our friends at Greenpeace lent us their blimp. We're not above a little stunt now and then to draw attention to things.
So now let's talk about you guys. You guys are Linux builders and users and enthusiasts, and I think that you matter a lot in this moment that we're in and in the coming moments. Let's talk about specifically, first of all, you build the tools, and if you build it, they will come. Sorry, I stole a little thing. I'm from Iowa, so whenever I have to, I get to show a little Field of Dreams. I'm very happy about it. But you get to decide if you're going to build encryption into what you make, if you're going to make it seamless and easy for people to use. My plea to the open source community for at least 30 years now is please, please, user interfaces. Please make things easy for people who are not technical to use. And I know that's not the fun part, but I'm here to tell you you need to do the not fun part, too.
Make privacy-preserving architectures the default in what you build. Minimize data collection and retention. Conduct and publish security research so we all get the most secure things. And push back on surveillance features that are being built into the products that you build. These are just builder-level things that people can do. And I think that they're important, but they're not it, because you're not just builders. You're actual human beings in the world as well. And I just want to pause for a moment and say I know that it can feel really dark right now. There's a lot going on. The surveillance that we were — I mean, sometimes I feel like Cassandra, right, where I've been warning about a future that nobody else could see. Not nobody — lots of people could see, but people in power couldn't see, and now we're living through it.
Surveillance that we were told was built for commercial purposes is being increasingly leveraged by the government. The government is the number one purchaser of data from data brokers right now and has been for the last couple of years. They're increasingly willing to use that information to weaponize against our neighbors and their targets. And those targets are increasingly more political than legal. The Trump administration's administrative order desiloing information means that information that you give to the government for one purpose, they're increasingly wanting to use for other purposes. This is one of the core privacy protections that comes out of something called the Federal Information Privacy Practice, or FIPS, if you're an old-school policy person — that data collected for one purpose shouldn't be reused for another purpose without clear consent — and they are violating that with this desiloing order.
There are new technologies that are tracking us everywhere we go: facial recognition, license plate readers, border surveillance, drones, other biometrics. We have created a national security-shaped hole in the Constitution. That's why you will hear not only this administration, but especially this administration, claim national security is the basis for everything they're doing. And that's because that's the easy road for them. And we built this. This was built. I didn't build it. I fought it. But this has been built over many, many administrations of both political parties. There is still a myth of going dark that continues to come after encryption technology. That's law enforcement's argument that unless they can have access to everybody's communications all the time, they are going dark and can't solve crimes. I just think that's, let's laugh out loud, ridiculous when you look at all the other tools that they have that have been supercharged by technology. And then we have things coming up. We've got neurotechnology, we've got quantum computing, we've got AI agents that are autonomous and doing all sorts of things and more.
So I think that while it feels dark right now, you know, Ben Franklin said at the signing of the Constitution, you know, we have a republic if you can keep it. I would submit we're in the 'if you can keep it' part of the republic. And it's incumbent upon all of us to not sit back in our little worlds and think that somebody else is going to take care of it. They're not. So what does that tell me? Well, that tells me that we have some things to learn about the cypherpunk legacy, right? They not only showed up in ill-fitting suits to that 1996 courtroom, they built PGP. They continued public crypto research. They pushed for privacy. They pushed against the laws that were getting in the way. They understood that technology alone wasn't going to solve this, that we needed law and society to support it. The technology is important. I love encryption. It's really magical in the way that it can protect privacy and security, but it's not a complete solution to anything. I think everybody in this room knows that just add encryption doesn't equal privacy or security. There's much, much more to it. Their work, though, enabled the internet that we have today, and you are the next generation.
So here's my pitch to you. Think about how you can join the fight. I have a few things here. Show up. Whether that's in the courtrooms, in the halls of Congress, at your local board of supervisors, or your local HOA, use these tools. Privacy is a team sport. So don't just use them yourself. Help other people learn how to use them, especially people who don't already know how to use them. Share, educate, welcome, cheer on newbies and oldies. I was with a woman last night who has been going into senior centers and helping people learn how to use encryption. Contribute. Help with the many privacy-protecting open source projects that exist. Advocate for encryption and other privacy protections, whether that's in your workplace or in public. You have agency as employees of some of the companies that are building this stuff. Don't forget it. They want you to think you have no power, and they are wrong.
Innovate. I think we're in a time when we really do need new ideas, both in technology and in the public conversation about things. Support. I'm EFF's executive director. I am almost contractually required to say please join EFF and give us your support. We do have people who get to do this over time, over the long run, and we get better at it because of that. I've been at EFF for 25 years. I have lawyers who have been with me for 20, 15, 10 years. The government's lawyers get to stay for the long run, and your continued solid support means that we can match them. We are already smarter than them, but we also get to be as experienced as them. And remember, while it can feel dark, the good guys always throw better parties. So you're a community, we're a community, and that's where we get our strength from — from each other.
You know, I joke at EFF sometimes that we have an outrage stick that we pass around so that, you know, one day I'm outraged at something that's happened and the next day somebody else is outraged and I get to support them as they work through their outrage. Share the outrage stick around with each other so that everybody gets a chance to be outraged, but also everybody gets a chance to be supported by the other people who just aren't in that mental state right now. And be kind to yourself and others. This is a marathon, not a sprint.
But I think if we all work together and try to figure out ways to make things better, we actually can. The cypherpunks — we were outnumbered, outgunned. We were a bunch of crazy, wild-eyed misfits when we showed up in federal court, and we were able to prevail. That was a path that I think people didn't think was available to us. That's one path, but it's not the only path. And what I'm encouraging you to do is not just go down a path that has been pre-printed out by us in the 1990s or some other movement for change. We can learn from those things, but I think that we need to figure out new strategies and new ideas to push for change and not get stuck just trying to replicate the ones from before. So that's my challenge to you.
I think the cypherpunks, while they were not perfect — and believe me, they were not perfect — it was not as welcoming as it should have been in many ways. It was a limited number of people who all tended to look alike and came from the same backgrounds. We have the opportunity to build a more diverse and broader range of work right now. But I think that their willingness to show up and push and build things and translate out from the technical world to the non-technical world provided me with the opportunity to do what I did, and hopefully she'll provide some inspiration for folks like you. So that's my pitch. I hope I recruited a couple of you. And I'm happy to answer any questions. And thank you very much for being my beta testers for book reading. I hope it was fun.
