This is Twit.
Hey, thanks for tuning in to Twit, your tech hub for intelligent, thoughtful conversations. If you want to take your experience to the next level and support what we do here at Twit, say goodbye to ads and say hello to Club Twit. With Club Twit, you unlock all our shows ad-free. You also get exclusive members-only content. We do a lot of great programming just for the club members. You also get behind-the-scenes access with our Twit Plus bonus feed and live video streams while we're recording. And don't forget the fantastic members-only Discord. It's where passionate tech fans like you and me hang out, swap ideas, and connect directly with all of our hosts. It's my favorite social network. I think you'll like it, too. Club Twit, it's not just a subscription. It's how you support what we do and become part of the Twit family. Your membership directly supports the network, helping us stay independent and keep making the shows you love. If you're ready to upgrade your tech podcast experience, head to twit.tv/clubtwit and join us today. Thanks for being here and I'll see you in the club.
Hello, club members. Good to see you. We have a big show for you today. We're so grateful to the club members who make this possible. Every once in a while, it's not a regular thing, but I still like to interview people who I think are super important to us all. And I don't think there's anybody more important than Cindy Cohn. She's been executive director of the Electronic Frontier Foundation for the last, well, it's 11 years now, winding up her tenure, but she's been privacy's defender for a lot longer. Cindy, welcome to the Twit microphones and thank you for doing this. I appreciate it.
Brand new book, Privacy's Defender. And it's kind of about your, it's a chronicle of your tenure at the EFF. You started back in the mid-'90s.
As just a pro bono, I presume, pro bono attorney.
In fact, this book is cool because, and I really like how you structured this, it's three trials.
And it's three seminal trials stretching back to 1996 all the way to the present. And of course, the battle rages on. And so the first thing I would say for anybody listening now is go to eff.org and sign up, donate, and support their work because it's so important to those of us who care about the internet and care about freedom and privacy. You're focusing on privacy here.
Yep.
Why privacy? Why is that the key element of all of this?
Well, I think it's an important one and it's been central to the three biggest fights that I've led as EFF's executive, well, first our legal director and now our executive director. Because I think it's a keystone to a lot of other rights. You know, privacy. People think of privacy and they think of kind of like the Harry Potter invisibility cloak that you put on before you do something. And that's certainly true, but it's really not why I think privacy is most important. I think privacy is important because it's a check on power. It's a way that less powerful people can have a place to organize and put things together and learn things that powerful people might not otherwise want them to have access to or to see. And without that privacy, I don't think you can be a self-governing society. People don't act the same way when they're being watched all the time. And that's especially important on the kind of political democracy side of things. So, you know, I think without privacy, you can't have many of the other rights that people care about and actually a self-governing society. If the people in power know everything you're seeing, doing, acting, and who you're talking to, you're not going to be able to organize power against them. So, this was one of the insights of the founders of the EFF, and it's the first case that, you know, they kind of roped me into or pulled me into, and it's just been a throughline. And I think it's especially important now. I think people, you know, we used to be talking about a scary future where the ability to marshal data against us was something that could happen. And now I think more and more people are seeing that we're actually living in a lot of that future and they're looking forward and they don't like what they see. So I hope it'll help people see like how we got here, that we didn't lose all the fights and that we can win other ones, but also the road ahead and what we need to do going forward.
Yeah. For a long time I thought, oh, privacy schmivacy. Privacy is dead. Get over it. Was it Scott McNealy? Whoever said that?
And you know, I thought, well, so what? I'm going to get an ad that's targeted at my interests. That seems like not a bad thing. But it became very clear. You know, people always come up with straw men. Well, an insurance company gets your information that you're eating donuts, they're not going to insure you and all that stuff. And I kind of poo-pooed that, but it is increasingly clear as, first of all, as you point out, technology has collected all this information, made it possible to cross-reference all this information in ways that the founders never considered. And now that we have not just marketers but nation states including our own and law enforcement using those databases with abandon, it becomes more and more significant. You know, we're going to talk about on Sunday the fact that a whistleblower says one of the DOGE kids took a thumb drive and took this Social Security database with 500 million records out of the SSA department and who knows where it ended up.
Yeah. Places it ended up. I mean, it's probably, you know, we have a case against the Office of Personnel Management for granting access to the DOGErs without proper security and privacy protections. I would not be surprised to find that something similar happened at OPM. The one about Social Security Administration I fear is the tip of the iceberg of this kind of stuff because, you know, they really didn't take seriously the privacy needs of the people whose data they had and, you know, the security needs as well, right? I mean, you know, this is information that is scary for us as individuals, but as a nation, you know, it's no surprise that the Chinese already tried to get in, got into the Office of Personnel Management.
Yeah, it already had a worthless, if it was worthless information that couldn't be used in any way to hurt you if you'd ever done anything wrong, why is it a target of foreign nation states, right?
We're not talking Temu here. We're talking the Chinese.
Yeah. So we're really concerned and I again I do worry, you know, we're going to be talking to a federal judge about the Office of Personnel Management case this spring and we got an injunction getting them out last year and we're going to try to do a little more now at the end of the case. But it's very worrisome and people are starting to see it. People are seeing, you know, we've got a terrible case out of Maine with cops, with law enforcement using facial recognition on protesters engaging in their First Amendment right to protest and saying your name is in the database now. Yep. And following them home, finding out where they lived and really, you know, because all of that data is now tied together. It's easier than ever to do that, to take your face, find out where you live, find out who the other people are, who you communicate with. So, even if you're not at risk, you know, you got to think about who else do you communicate with and what are their risk factors as well. So, we're starting to see, you know, I feel a little sometimes like I've been a Cassandra, right? Like, terrible things are going to happen. And now, you know, we're seeing a lot of this really come alive and be a reality in people's lives in a way that is really happening. And it's easier and easier for me to convince people that this is a problem, but not in a good way.
In a perverse way, you must be a little bit gratified, right?
See, I told you.
Yeah. It's a weird, you know, kind of feeling, but, you know, I would rather have been wrong about this stuff.
So, correct me if I'm wrong, but the word privacy does not appear in the Constitution.
No, the Fourth Amendment is about being secure in your papers and things. And, you know, people have always read that secure in your papers to mean that law enforcement can't get at it without a probable cause warrant, which effectively gives you privacy. So the word privacy isn't in the U.S. Constitution. It is in the California Constitution and many state constitutions.
And now, thanks to the CCPA.
But it's never been, not never, but it's pretty longstanding the idea that the Fourth Amendment is fundamentally about privacy. The First Amendment has the right to speak anonymously. That's very, very old. Way predates the internet and that requires privacy, right? To not be identified with everything that you might say because that could lead to retaliation by the government. So that's a kind of privacy as well that's baked into the First Amendment.
Right. Privacy and the First Amendment crossed in your first case. You were just out of law school.
And I don't know if people, probably a lot of people who are watching, younger people don't remember that encryption was considered munitions.
It was something the U.S. government was trying to keep out of the hands of everybody else. There's a famous story of a fellow wearing a T-shirt with the encryption algorithm on it.
It's the math is that simple.
So tell me, this is in 1996. You've just taken the case. Judge Marilyn Hall Patel was the judge. What were you arguing? And the case was over, forgive me, I'm not a law student. I'm not good at stating the facts of the case. But it was Daniel Bernstein, who is a Berkeley math student, had developed an algorithm, wanted to publish the algorithm. The State Department said no, if you're going to do that, you have to register as an arms dealer.
Correct. Correct. So the U.S. munitions list is the list of all the things you can't export from the United States without a license. It's got things on it that you might expect like surface-to-air missiles and tanks and things like that.
But it also had on it in the '90s software with the capability of maintaining secrecy. And, you know, if you think about historically, it's not that crazy because, you know, we won World War II because we were able to break the Germans' code machine and the Japanese codes, the Purple as well. So it's not crazy that the U.S. government kind of thought of software with the capability of maintaining secrecy as part of war and defense. But it was increasingly clear, especially to, you know, some of the founders of EFF and early internet people, that this government control over the tool of security and privacy and encryption is kind of this magical thing that gives us both security and privacy, that that was going to get in the way of us building a secure internet. And so we took on the licensing regime that was then run by the State Department on behalf of a math PhD student at UC Berkeley named Dan Bernstein. And we challenged it and we said, you know, I mean, the second piece of this is that not only was software with the capability of maintaining secrecy called ammunition, but publishing something on the internet is an export because foreigners can get access to it. But it's also publication. And so we brought a case against the licensing scheme under the First Amendment, under a specific part of the First Amendment called the prior restraint doctrine that applies to licensing. So you have to go and ask for permission before you can say something, that's a prior restraint, and that has very, very high standards in the law when the government can do it. So we challenged the licensing regimes as a prior restraint on speech and we won. The judge agreed with us that these encryption regulations didn't properly take into account that they were reaching speech when it came to encryption and threw them out. And we won at the district court level. We won at the Ninth Circuit Court of Appeals. And then about that time, the government, I think Al Gore wanted to be president. He was a guy who knew about technology and wanted Silicon Valley's support. And between the political pressure and the legal pressure that we brought and some pressure in Congress, the government backed down. And, you know, the encryption regulations now are a shadow of what they were before. They don't get in the way. And that's why we all have, you know, whether it's Signal or WhatsApp has encryption, Apple Messages has encryption, or even like some of the backend stuff that people don't see, like Let's Encrypt certificate authorities and things like that that help, you know, put the HTTPS, the S part on things. All of those are because we were able to free up encryption and build it and really bake it in to lots of pieces of the internet in ways that we could not do so in the '90s.
We're talking to Cindy Cohn, who's the executive director of the Electronic Frontier Foundation. Her new book just came out, Privacy's Defender: My 30-Year Fight Against Digital Surveillance. Congratulations. Came out two days ago. I'm sure it's, I hope it's selling well. People should be reading this. It's interesting because now you won and we don't ever have to worry about encryption being thwarted ever again, right? I mean, congratulations.
It turns out it doesn't work that way. I mean, I would say, you know, had we not won, the world would have, the internet would have looked a lot different. The world would have looked a lot different. It's important that we won. But yeah, it's not like the NSA just kind of hung up their... Okay. And went home. Yeah. We learned later that they were doing a lot of work directly to companies trying to weaken the encryption that the companies would offer to people. We learned that they were doing a whole lot of other kinds of tapping into the weak spots of the internet. Many of these we kind of heard about a little bit, but a lot of it was revealed by Mr. Snowden in 2013, who really brought forth a lot of the evidence about the various ways that the government was trying to undermine encryption so that they could always have access. And then we've had some straight-ahead attacks as well, especially right now in Australia and Europe, we're seeing real direct attacks on encryption. So it continues to be a fight. I'm, you know, it's baked into enough things that enough people rely on that it's, they're fights that we are maybe not entirely winning, but winning more than, you know, where we started in the '90s. But yeah, it's, you know, the one thing you learn when you're going up against the national security infrastructure, it's not like a TV show, you know, where by the third commercial it's all done and you're ready for the, you know, the previews for the next episode. You always have to keep pushing back on them. And you have to keep holding the line. And while the encryption win was fairly clean compared to some of the others, the other two stories I tell in the book are a little more, a little less clean in terms of the ways that we had to chip away and fight and we'd win one and we'd lose one and we'd go back and forth and really needed to, you know, kind of be girded in for the long haul to try to do wins. We didn't have that same kind of clean win after the encryption one.
Although you can celebrate because many years later Apple referred to this case when it refused to unlock the San Bernardino terrorist's iPhone.
The FBI was demanding it and they used you as a precedent.
Yeah. We succeeded. Yeah. And they were right. You know, we tell the companies all the time that, you know, we're kind of frenemies, right? If they stand with their users, we stand with them. And if they stand opposing their users, we're the first in line. And, you know, that was one where Apple did the right thing and we were perfectly happy to say so and to stand with them. Some of the other things Apple's done, maybe not so much, but we try to call them as we see them. And that was one where the work that we did in the '90s, I think, made it easier and clearer for Apple to say, you know, we're going to make, we're not going to make everyone insecure as a side effect of this one investigation. That's not right.
And that's kind of the fundamental thing you point out, that encryption is a double-edged sword. It protects both the innocent and the guilty.
It sure does. But I, you know, I always try to think about it like, you know, what is it that we want the government to be able to do in order to protect us and what is the consequence of that? And, you know, if your local police came up to you and said, 'Look, we've got a problem of burglaries in the neighborhood. And so what we want you to do is to keep your back door open. So in case you're a burglar or a burglar ends up coming into your house, we have really easy access. That's how we're going to keep you safe.' You would look at them and be like, 'Find a better job. Give it up. You're making me less safe. You're making me less safe to bad guys. I should not be one of your suspects.' I mean, this is, you're doing this for everybody. And you would think that that was ridiculous, but that's effectively the law enforcement argument about encryption is that we should all be less safe so that they can do their jobs a little easier. And it's just not the right trade-off. It's wrong. And it's just as wrong as if they asked you to hold your back door open. It's just that because it's digital and involves, you know, fancy math, you know, they hope that people won't notice that that is actually what they're trying to do. And I think this is one where we just need to hold the line. There isn't really a middle ground where you, you know, the technology doesn't know the difference between a good guy and a bad guy knocking on the door. So if you dumb down the technology with the idea that only good guys are ever going to use it, like, that's a fool's game. That's not how it will work.
Yeah, they always say, 'Well, we could keep the keys in escrow. You don't have to. You could trust us.' But we already know. We just talked about breaches with the OPM and the Social Security Administration. We know that that's not...
They tried it with a Clipper chip, you know, way back in the '90s, right? And Al Gore's Clipper broke it in like two days. So, you know, they don't have a very good record of it. And that's because it's a really hard thing to do. It's not because they're, I mean, they are inept, but it is actually a really hard thing to do. And it also depends on the government always being in the hands of people who are going to be responsible. And I think right now we're really in a moment where we're starting to see what happens when the government decides that it doesn't have to be responsible with our data, that it's using some of these technologies in ways that I think a lot of people object to. It's decided that the information you give to the IRS, which, you know, the long-standing deal was you tell the truth to the IRS and that information won't go anywhere else. And now they're pushing to the very edge to be able to use IRS data to try to do other things. And, you know, right now they're targeting immigrants and looking for, you know, what they claim are illegal immigrants. But I don't think, you know, that that's not where it's stopping. They're now going after protesters. They're going after other political opponents. So, you know, it also presumes that the people in power, you know, that it's okay for you to be less secure because the people in power will always be trustworthy and people who you agree with about where they're targeting things. And I just don't think history right now is supporting that idea. I think it's better if we're just secure. I think that's one of the things that has been an eye-opener for many of us in the last eight years or 12 years is how much of what we think of as the force of law is really just the force of norms.
And when you have an administration or you have law enforcement that is willing to violate norms, it almost seems like there's nothing to stop them. Are you optimistic about the ability of our Constitution and the courts to keep a lid on this stuff?
I mean, I don't know. I'm not very good at optimism or pessimism, honestly. I mean, I'm kind of fundamentally somebody who's like, it's not going to happen magically, right? You know, sometimes optimism makes you think, well, you don't have to do anything. You can just sit back and things will magically get right. I've never been that kind of an optimist. I think that if we dig in and we fight and we push back, that we can make real change, that we can step up and we can protect people better than if we don't. I mean, I kind of feel like right now we just have two paths, right? One is we don't fight and they just win. And the other is we do fight and maybe they win, but they won't win as much and maybe we win. And those are really the only paths. I mean, you can't really opt out of the decision about whether we're going to live in a democracy or not. You know, I've been quoting Ben Franklin recently, you know, at the passage of the Constitution. He was kind of a grumpy old guy at this point. And he got asked, 'Well, what did you guys vote on? Did you vote on a monarchy or a republic?' And he said, 'A republic if you can keep it.' And I think we're in the 'if you can keep it' part of that statement. And that means we all have to step up. So I don't know if we're going to win all the fights that we did, but I know that we will never win any fights we don't start.
Yeah. Now let's talk about Room 641A.
A room you know. Well, this is a famous case. We talked a lot about this one. An AT&T technician named Mark Klein...
was a whistleblower. Came to EFF, right?
Yeah. He knocked on our front door.
A trench coat with files. No. Knocked on the front door of EFF's offices and said, 'Do you guys care about privacy?' And luckily, you know, Shari Steele, who was our executive director at the time, answered the door and she said, 'Well, sure. Come on in.'
Yeah, we do a little. Yeah. Easily said, you know, there's a lot of people on Shotwell Street in the Mission who you might not get in that easily. Yeah.
But she made the right decision and Mark showed up at our front door with the schematics of how some of the mass spying that the government was doing was actually happening in a building on Folsom Street in San Francisco in a secret room called Room 641A on the sixth floor. They had installed, the NSA had installed equipment that basically intercepted all the traffic routed through AT&T and sent it off to the government.
Yeah. Through the switching station, through the upstream part, but yeah.
So it was internet backbone traffic. It wasn't phone traffic. Okay.
And so what did the EFF do in response to the guy in the trench coat?
Yeah. Well, we had already been working on a case. You know, the New York Times had released some information just a couple weeks earlier, which is how Mark put it together. He saw the New York Times story and he went, 'Wow, that little kind of shady thing I saw that I didn't understand what it was, I think that was this.'
So, the New York Times helped Mark put together something that he had been concerned about, but didn't really understand what it was. And then he brought it to us. So, we were already working on a case at the time and we ended up launching a case just a couple weeks later called Hepting v. AT&T. We decided to sue the phone company rather than the government because the government has a lot of immunities and there's a lot of gray areas in some of this. But the phone companies have actually a straight-up statutory requirement that Congress said that they can't do anything with your phone calls and internet traffic other than route it and protect their own networks. And so it was very easy to show that letting the government tap in and do what it wanted with the information was not legal under the statute. So we sued AT&T in the Northern District of California here in San Francisco.
And you won and the case is over and we're all free at last. Free at last.
We won initially, right? I mean, the first thing AT&T tried to do was to make us give all the information back and that didn't fly.
That's our private information. You're not supposed to have that.
Yeah. Yeah. It was proprietary, which, you know, on some level they thought they were being really tough by calling it proprietary information, but, you know, they made it clear that it was real. You know, we had always in the back wondered if it was real or not, but once somebody comes up and says that's ours, we need it back, we were like, 'Okay, well, you've...' Lawyers call this authentication. They authenticated it for us.
And then the judge initially agreed with us that the case had to be able to go forward, that everybody in the world at this point, because of all the press coverage, knew about this NSA spying and that the case shouldn't be dismissed. Now, we went back and forth and up and down. And ultimately, oh my gosh, 16 or 17 years later, the Supreme Court said essentially that even though everybody knows this, it's still a secret which companies are doing it, which is crazy. There's only two phone companies in the United States of any size, right? AT&T and Verizon. So it's a secret whether AT&T is participating in this program. And so, therefore, we're going to dismiss the case. And it was in a slightly different case than ours, but it had implications for ours. And it's really wrong. I think it's really problematic. It's not like people don't know now. They knew in 2006 and certainly after Mr. Snowden came forward, it wasn't like this was all made up. And it was ripe for the court to decide whether it was legal and consistent with the Constitution rather than hiding behind this secrecy thing. And so there's work for us to do. You know, in the meantime, we had sued over three programs. I'm left-handed. I got to move over here.
We had to, there were three programs. There was mass telephone records collection. There was internet metadata collection. And there was this tapping into the backbone that Mark told us about. You know, two of those programs, one of those programs ended entirely. The internet metadata program, the phone records program got dramatically changed by Congress. It's still too big, but it got dramatically cut back. And then the mass tapping into the internet, while it's still going on, is just now metadata and isn't content anymore. And we got the FISA court involved at a much, you know, not enough, but a much deeper level than we did before. So, this is what I mean by chipping away. Like, it's not like, it's true, we didn't win our case, but we won a lot of pieces along the way and slowly are chipping away at this. And when you're up against the national security part of the United States, they're very, very powerful and they have a lot of tricks up their sleeve and they have a lot of ability to scare members of Congress. So, when you get any little victory, it's a pretty big deal.
Yeah. The Supreme Court used what I consider almost a legal trick, saying you can't sue unless you can prove you were surveilled. But of course, if you don't have access to the information, the classified information, you can't prove it.
So, it's a loophole kind of.
Yeah. It was this weird circular logic, right? It was crazy from our perspective. It's like, well, first of all, you know, in most lawsuits, that's what discovery is for, right? You launch a lawsuit, you might not know all the facts. You just know you've been hurt and you don't really know, you might not know all the reasons why. Let's say you're suing a company that made a product that hurt you. But we were not allowed to do the discovery against the government because they kept claiming secrecy over everything and the judge let them get away with it. So, at the end of the case, they're like, 'Well, you don't have enough information to prove that this mass surveillance is actually happening at AT&T.' And we're like, 'Well, you blocked every avenue for us to get the government to force the government to confirm what we were saying or to get us other information that would be admissible.' So, we really did feel like we had been, you know, kind of checkmated in a way that wasn't fair.
Yeah. And the Supreme Court ultimately decided not to rule. They denied cert.
Those must be discouraging times when...
It's really discouraging. It's really hard. On the other hand, again, you know, it was good to write the book to actually look back because I was really, believe me, I like, and I'm a litigator. I like to win. I didn't think this was right. But sitting back and writing the book and looking at it and actually counting up all the things we won along the way, including stuff that, you know, we got the FISA court to publish its docket and publish its report. So people now have a lot clearer idea of the big decisions that the FISA court made. There's all sorts of things along the way where we've built some transparency and accountability into these processes that were 100% hidden from the American people for many, many years. So those are good things. Again, there's still road ahead. We have a lot more to do. But we did accomplish a lot considering where we started.
Yeah, you sure did. And I guess that's the attitude to take is we're making baby steps as best we can. Because I don't think a total victory is going to happen. Even if you accomplish that, there are many forces arrayed against you.
Yeah. I mean, the national security folks and like we want there to be a balance, right? We don't want national security to not have a lot of power. It should have a lot of power. It's just that the rest...
The rest of us need to have our rights too. And this is always a balance, right? The whole Constitution is about thou shalt not for government, right? It's about ways that the things that we need to protect, especially the Bill of Rights, that we need to protect ourselves against a despotic government and a way to strike the balance of keeping us safe while also keeping us free. And we just think the balance for too long has been if law enforcement or if national security wants it, then the answer is yes, and we need to reassert the other side. That doesn't mean they won't have powers. They should have powers. It just means we have to balance it a little better.
Yeah. I think there are a lot of people, I include myself in this, who see everything very black and white. And if we can't have that, then we're screwed. And I think you have a more nuanced point of view from many years in the trenches that, you know, you get these little victories. You do what you can. You inch ahead. Because it isn't black and white and there is no total victory on either side. So you've just got to fight.
Yeah, is that something you have, sorry, Tori says this thing, right? You have to keep fighting to look for higher ground. Right. Right. And then once you get to higher ground, you may see the next thing, the next step. Right. But you just, this is the nature of this kind of work.
I have a lot of stamina. I don't know. Job security. I don't know. Do you feel like you have unusual stamina? I know Cory does.
Well, Cory is crazy. He has far more than me. Well, I think my strategy is more that we have a team. Yeah. We have people. We share it. Like, it's not all on me. It's never been, I haven't done any single one of these things by myself. I've always had a team and a community and places to step back and rest and recharge. I used to joke at EFF that we had like the outrage, we had like the outrage stick, you know, and so one person could have the stick at a time and then they get to, then they pass and then the next thing that happens and the next person gets to be outraged and the rest of us are there to support them and to keep going forward because everybody's going to get outraged and everybody's going to get despondent. But in the long run, you know, if you have a community and you have a team, you can do this for the long run. And again, part of why I wrote it as a memoir and my personal story is that, you know, along the way really interesting things happen, right? It's not just about the fight.
Right. You're right. Outrage is exhausting and often just you end up giving up because it's just so much outrage. So much. Did you, is this something you wanted to do as a...
Kid? I mean, how did this happen? I mean, there was no EFF when you were growing up.
Oh, no. And I would not have—I mean, I'm an English major. Like, I am not a technical person either. Now, I've always really loved them. I've always liked the, you know, the kind of the way that technical people think and approach the world has always been—I've always thought that was great. I used to, you know, I'm not a technologist, but I'm kind of techphilic. Um, but I, you know, I just always knew I wanted to stand up for people who had less power. And some of this I tell a little bit in the story about a couple incidents from my childhood where somebody stood up for me and how important that was for me and it made me think that's what I wanted to do. And then the tech thing, I really just fell into it. Like I moved to San Francisco. I had a party and a bunch of hackers showed up at my house and one, you know, one of them was John Gilmore. Another one was somebody who I dated. Um, and I just started hanging out with these people and they were thinking about what the world would look like when everybody got the technology that they were already playing with. You know, some of these people were, you know, out of MIT, out of the media lab and places like that. And um, I was interested in making the world a better place. I came out of—I did international human rights law in Geneva. And I just started seeing how what they were building was going to be really important to rights. And then, you know, I would say somewhat randomly, John Gilmore called me up one day and said, 'Would you do this case for Dan Bernstein?' And I thought, well, this is a chance to take what I care about—about rights and the possibilities of this technology—and mirror it, you know, over to the tech world and use my lawyer skills. So, I just got—I think I got lucky that I got this opportunity, but I was also open to it.
I have somewhere John Gilmore I think signed the DES cracker board.
Yeah. I have a board with one chip in it, but obviously it was a failed board. Have to find that somewhere and hang it up because it's a great piece of history. I hope people—well, this book will help people remember those days.
Yeah, I hope so. So, John, just for a little backstory. I don't know who your audience is, but the backstory.
Oh, they're geeks. Many of them will know.
No, they know about DES. And DES was weak and John couldn't convince anybody that DES was weak. So, he basically pulled together a team with EFF and built something to show how easy it was—that this was the government's encryption standard that they were saying was really strong—and how, like, you know, with like less than a half a million dollars, they were able to build something that cracked it. Um, and that helps spur the change to what now we have as the Advanced Encryption Standard. Um, and a much better process. You know, people are working on post-quantum cryptography now. And those processes are open and transparent at a level that really grew out of the work that John spearheaded about the need for transparency and real science behind security.
Yeah, it was before I got involved, but EFF started because there were some Secret Service raids on people who were doing things in early, like, you know, newsgroups, working groups. Um, there was one—there were a couple where there was an argument that the FBI got sold an argument that some conversations that were happening in this new digital world were very scary and they started doing raids on people and interviewing people who were involved in the internet. And two of the early people that the FBI came and visited were John Perry Barlow and Mitch Kapor. Uh, Mitch, of course, wrote, you know, the very first—or helped develop Lotus 1-2-3, Lotus Notes—and so he was already kind of a rich tech guy. And Barlow was, you know, very interested in early internet, active in the WELL, which was an early—
You were on the WELL, yeah.
There was a bunch of Deadheads too on the WELL, absolutely. I mean, between the Grateful Dead psychedelic world and the tech world in the '90s was really clear. But John Markoff wrote a whole book about—
That's right, what the Dormouse said, yeah. Yeah, but both Mitch and Barlow had these weird visits from the FBI where it became clear to them that the FBI didn't really know what was going on in this new world and was doing really dumb things as a result of it. And so they put their heads together and very quickly John Gilmore got involved and decided that they needed to start an organization to defend some of these people who were getting caught up in these raids. And they called it the Electronic Frontier Foundation with the idea that they would give grants to lawyers to defend some of these people. I joke at this point that, you know, we're neither just electronic, it's not really a frontier anymore, and we're not a foundation. Like, none of these words are who we are anymore. But they put EFF together and they couldn't find any lawyers who knew enough about this world to actually give them the grant. I mean, they did a few and we had some early people who were involved in that. Um, but you know, so they started hiring kind of lawyers in-house. Uh, the very first one was somebody named Mike Godwin, who people probably heard of Godwin's Law, and really started putting together an organization to try to help make sure that, you know, the people who were inhabiting this new digital world had their rights protected. I often say, you know, EFF was created so that when you go online, your rights go with you. Um, and especially building, you know, kind of a digital world that would stand with the users. So that, you know, it was created with this kind of visionary idea of, you know, what was the world going to look like when everybody had this technology that in 1990 not that many people did, and to defend some of the people. The very first case that EFF took on was for Steve Jackson Games. A little gaming company in Austin people may be familiar with. And—
They took all their computers.
Yeah. Everything that was plugged into the wall.
And you know, they had a hard time getting it back.
So, the very first case that EFF took was about establishing, you know, what does the government get if they've got a warrant to search your house for technology, and really limiting them to just the stuff that's related to the actual investigation. We're still fighting that fight today. We still see these overbroad warrants where they seize everything. And so, we, you know, continue to have to stand up for that at EFF even today, although it's gotten better. Of course, no one can forget the very sad story of Aaron Swartz, um, our friend, and another guy who was kind of overprosecuted.
Absolutely. Absolutely. And, you know, Aaron was a dear friend of mine. Um, you know, and he was prosecuted for trying to free information—for people to have information that we paid for, taxpayers, for this information. And he tried to free it so that we could do things with it. Uh, and it wasn't just locked up in these commercial databases that academics pay a lot of money to have access to. Um, and he was overprosecuted and ultimately ended his own life. It was still a tragedy.
