Privacy's Defender: An Interview With EFF's Cindy Cohn

Oh my gosh, what a kind introduction. Thank you. It's my pleasure.

Well, I mean, I think there's still a big misunderstanding about privacy. I think about privacy a little differently than most people. A lot of people think about privacy like the, you know, Harry Potter invisibility cloak that you throw over your head when you're about to do something kind of, you know, untoward or something. And I know that's certainly something privacy does, but it's not why it's important. Privacy is a way that people with less power can have protection against people who have more power. And you can see that from the kind of, you know, very small inside the house stories all the way up to the government. And you know, when I say inside the house, I'm thinking about some of the people that we work with who are domestic violence victims who have malware placed on their devices by their abusers. Why? So the abusers can surveil them. Why? So their abusers have more power over them and they have less power over them. And this scales all the way up to the government. The reason that, you know, one of the impacts of mass surveillance, especially, but even targeted surveillance on us by our government is to make sure that our government has more power over us and that we have less power over it. You can't decide who to vote for and vote for somebody who isn't the person in power if you're being watched, or at least it intimidates people, and that's very well documented. It's also, you know, we're seeing it on the commercial side as well, the amount of information that companies have on us and data brokers and others is increasingly being used to do things like set the prices we pay based upon their evaluation of how much money we have, or decide what opportunities we get based upon what they know about the rest of our lives. It's really changing again the relative power. And I think if you start looking at privacy that way, you begin to see why it's really important and why it's embedded in our constitutional framework. Why it's embedded in like the Fourth Amendment. The right to be secure in your papers and your home is about you having power, a protection against the power of government over you.

Yeah, well, in the United States, I think it's held up pretty well around kind of core First Amendment issues. That was one of the very first internet decisions, ACLU versus Reno in the late '90s, that recognized that the internet was a place of freedom of expression. Now, it's not like we don't have fights about it, but that threshold finding really set everything else up in a way that has benefited, I think, ordinary people quite a bit. And again, it's not like we don't have free speech fights still. We certainly do, but we were set up pretty well and we start from a position of, yes, the Constitution protects what you say online the same way it would protect the things that you say offline. I think that's probably the biggest place where things have gone well. I mean, I think we did okay on like protecting privacy tools, specifically encryption, because we also got an early win in the '90s in the case that I handled in the Bernstein case about freeing up the tools that help people get privacy online. The encryption fights were about that. So, we also set that up and the idea that code is speech, recognizing that the science underlying our technology should be protected just like the science of chemistry is protected and the science of physics is protected, that that kind of threshold protection has been useful as we've moved forward for innovators, people who want to build things, want to interact with things, and build things that help keep us safer. So, I think those were good things that happened in the '90s in the early days and it was good that the EFF and a bunch of other folks got in there early on to try to set the table. Now, you know, here we are in 2026 and things are not looking near as great, and we realize that, you know, I say that when you go online, your rights should go with you because we've always recognized that that's not magically going to happen. We have to have a fight and those fights can change over time. You know, and we're certainly in the midst of big fights right now around people's privacy and we're seeing, you know, there's a Supreme Court case that's up at the Supreme Court right now about whether your Fourth Amendment rights include protection against the ability for the government to seek these really broad warrants called geofence warrants where they ask for the location of everybody who is around a particular place at that time. So, rather than having individualized suspicion and using that warrant to get information after you, they're getting these warrants that are broad and get everybody. That is a sea change from how the Fourth Amendment used to work and we're going to see whether the courts are going to recognize what we see as an obvious attempt by the government to use new technologies to shrink people's rights.

[laughter] Yeah, I'm not sure how it's going to go, right? It may be something we don't win the first time and we'll have to come back on. I mean, I think the thing for people to remember in all of these fights, and this is true offline and online, like this is always a process. And we win some and we lose some. And you know, and that certainly the people who want to reduce our rights don't just take the loss and go away. So, those of us who are trying to vindicate our rights should recognize that, you know, it is an ongoing process to try to stand up for people's rights. And that means we have to be resilient when things don't go our way and persistent and patient. And all of those things are really hard when some of these things are a matter of life and death.

I think Bernstein holds up as far as it goes. I think that the important thing to remember is just getting into the realm of the First Amendment doesn't actually end the inquiry about whether a rule is going to survive the First Amendment or not. I think sometimes, and honestly I think there was good reason for this before kind of more recent era, that once you got it into the realm of the First Amendment, that meant the government couldn't do it. And that has been true for certain situations, but I think that as somebody who lives inside the First Amendment, it's always been the case that getting into the general bucket of the First Amendment is only the first step in deciding whether the government can do what it wants to do. And you know, kind of the legal framework has these things called levels of scrutiny, right? There's strict scrutiny, intermediate scrutiny, rational basis scrutiny. And what that means is the courts, once you decide it's in the bucket of the First Amendment, have to look more closely at what is the fit between what the government's trying to do and what it's actually doing. What is the government's goal? Is it about the content of the message? Is it about a censorship goal? Or is it about something else? And those kinds of things. And they kind of get you into the muck of what's actually going on with this rule and this software to decide whether the rule is going to be upheld. And what we've seen, you know, the Bernstein case in some ways was in the strongest part of the First Amendment. It was in a part called prior restraint, which is when can the government tell you you can't speak even before you speak. And that has very, very high standards and the encryption regulations just didn't meet those standards and that is completely true. But that doesn't tell you what to do about any kind of government regulation, especially a kind of code, especially a kind that is not a licensing scheme of prior restraint kind of scheme. You have to make those evaluations and in subsequent cases the courts have begun to kind of map out what that looks like. So in some of the cases under the Digital Millennium Copyright Act anti-circumvention provisions, I'm happy to back up and explain that, but I know you've got a pretty technically proficient audience. But in some of those questions when we argued about the First Amendment, the courts adopted intermediate scrutiny, kind of an evaluation of the fit between the means and the ends, and found that the anti-circumvention provisions were sufficient. Now, I'm not sure I agree with that decision, but I understand the framework that the court was talking to. So I mean, this is kind of, I got deep lawyer geekery there for a second, but I think that sometimes especially people who don't come out of the law think, well, if code is speech then the government can never write a regulation that reaches code, and that has never been true. It doesn't require rethinking Bernstein. It just requires understanding where Bernstein fits in the panoply of government regulations.

How many times has that happened?

I mean, look, scholars disagree about the original intent, and I'm not much of an originalist, but I do think there is this idea that came up actually later, but was kind of articulated by a justice later about this idea of the marketplace of ideas, right? This idea that everybody has their opinions, and the truth will emerge because people are smart and thoughtful, and they will decide that the flat Earth people really aren't supported by any science, and follow the science, and end up in an Earth is round and we circle around the sun kind of way of thinking about it. Everyone can think about the kind of geography and Ptolemy and all of that stuff. And so that has become the accepted theory around the First Amendment and I think there's still a lot of support for that. There certainly is in the US Supreme Court and you know the set of risks from misinformation and disinformation are not really well handled by a First Amendment analysis. You know, I tend to think that if we actually took a privacy-first approach to this, we could shrink that problem down. Now we wouldn't get rid of it. I mean look, we need to educate people so they understand enough about science to be able to understand why the flat-earthers are wrong and the earth, you know, like I mean at a certain level First Amendment analysis cannot fix a lack of education because we have a country that's built on the idea that people are educated and smart and learn things. And I'm not sure you can law your way out of that problem. But and I worry a lot about censorship schemes that basically put somebody else in charge making sure that dumb people don't have exposure to dumb ideas because whoever you put in charge of that is really, really powerful. Right? I think a lot of people would like to do something about misinformation and disinformation, but they would disagree dramatically about who should be the person who decides what other people see. You know, and I think that's pretty clear right now in the United States. I think a lot of the people who are really worried about misinformation and disinformation would not trust the current federal government to be the decider about truth or not. And yet once you decide that somebody's going to decide, you have to decide who that person is. And the First Amendment wasn't, to me anyway, isn't the reason it protects people saying things that are not true and other kinds of things like that is not because we want a society that's full of people saying things that aren't true. We recognize the power of, you know, there's an old line that, you know, a lie can make it halfway around the world before the truth gets its boots on, right? That way predates the internet. You know, I think [clears throat] that was Will Rogers. But the reason that we don't like censorship approaches to these problems is because then you got to pick a king. You got to pick a decider about censorship. And in America right now, I think a lot of people are rightfully worried that if we, you know, that wouldn't yield a better decider. We don't have good deciders right now. You know, nobody wants Mark Zuckerberg to be the decider. I think people don't want Elon Musk to be the decider. So is it the big platforms to decide what's true or not? Well, let's look who's in charge of those and are we comfortable with that leadership? Let's look who's in charge of our government. I think there are lots of people who wouldn't want the Trump administration to do it, but there's actually a huge number of people who wouldn't want leading Democrats to be the ones who decide that either. It's a bipartisan concern about electing a censor. And I think that's why I lean towards other kinds of approaches to get at these problems. And one of them is really privacy. It's the idea that this surveillance business model, back to where we started, you know, more powerful people having power over less powerful people. If we give people privacy and stop this kind of ability, make it harder to do the hyper-targeting. So, the people who are most likely to fall for flat Earth stuff are the ones that see it in their feeds and stuff, get it presented to them, and we make it a little bit harder to hyper-target individuals based upon their vulnerabilities. I think we will begin to have some leeway on this. And one of the ways you can see this is, you know, one of the problems that I think lots of people are concerned about is kind of young girls being constantly exposed to stuff that feeds body dysmorphia. Whether you're talking about bulimia or anorexia or other kinds of body image problems, the fact that it's really easy to find and target those young vulnerable girls with your ads and your information is a side effect of the surveillance business model. And if we cut the knees out from under that, I think it wouldn't be nearly so powerful. We wouldn't fix it, but we would really address it in a way that doesn't empower a censor. And I think we should try all of those things before we decide we're going to elect a grand censor.

Well, I think that, I mean, first of all, you know, I'm still very grateful to Snowden for the risks that he took and the way that he helped open everybody's eyes to something. You know, we had been suing over the mass surveillance for 7 years before Snowden showed up. And the government had been getting away with essentially lying about it. And after Snowden's information came forward, they were no longer able to lie about it and we had to actually begin to face it at a level and it got brought under, you know, some congressional oversight. Actually, the big mass surveillance programs that we sued over are up for renewal right now and in the next couple of weeks in June, we'll see if we get a warrant requirement for access to that information. I'm not optimistic, but it's actually the Freedom Caucus Republicans who are the ones who are making the strongest stance right now. Because the Democrats don't have any power in Congress. So it's not like we don't have Democratic support, but we don't have enough. And the people who are blocking things and making it be kicked down the road are the Republicans. So, I think Snowden brought a start of accountability, but we didn't end it. We were not able to, the national security folks were really able to convince enough people that surveillance equals safety. And I think that plus just a flood of money into local police, you know, local communities is when you're talking about Flock cameras and all these mass surveillance tools are making their ways into local communities often over the very strong objection of the people in those communities. I think the other thing that people, I think people who saw the Snowden revelations kind of thought was that America was still sufficiently democratic that people would be able to vote and decide whether they wanted these technologies in their communities. And I think there's a sad realization by a lot of people that most law enforcement really isn't accountable to the local communities at the level that people thought. So, sadly one of the things I think the Snowden...

Revelations helped reveal is how far we've drifted from an accountable democracy when it comes to our law enforcement and national security infrastructures, and how much they really operate in their own world without a lot of public oversight. And I think that shows the work that has to be done, but it's sad. Like, you know, we work with groups all across the country who are like, "We don't want these cameras in our community." And they go and they bring hundreds of people into, you know, local meetings about it. And, you know, like in Berkeley recently, the mayor of Berkeley is saying we don't want this, the community doesn't want it, and the cops are like, yeah, well, we're not accountable to you, we're going to get it anyway. And I think that there's a lot of local systems where the cops have really emerged to be above the law. And, you know, so we're working with communities. I think we can get it back, but I feel like underneath all of this is this idea that surveillance equals safety that they have successfully sold at least to governmental officials, if not to citizens, in lots of places. And it's something we really have to face as a society. And we have to be able to face it with real information. You know, there's a problem now that law enforcement only tells us about their wins, and they don't tell us about their losses. And as a result, people get a very, you know, I talk about misinformation and disinformation, the lack of information about how all these tools are being used by local law enforcement and how well they are doing compared to the cost is a huge black hole right now.

I mean, look, it's such a race to the bottom, right? They're both really hard. They're hard in different ways. And as you pointed out, like sometimes I get asked, like you asked me a different question this time, sometimes you ask this, which one are you more afraid of? And the answer is like, you don't understand the problem if you think you get to choose.

Nobody is offering you the choice of government surveillance versus corporate surveillance. They work together, and as you know, the number one purchaser of information from the private sector data brokers is the government. So, they're all intertwined. I think in court, like, there's different things. You know, there are tools that we have to go against the government, like the Fourth Amendment, the Electronic Communications Privacy Act, a lot of, I think, tools that we have to go against the government that we don't have with the private sector as easily. But they also have a lot of immunities, right? Government agents have all of these qualified immunities and other kinds of immunity. So, even if you catch them cold dead to rights, the courts can say, "Well, this is novel. It's never come up before. How was a lowly police officer supposed to know that this was a violation of rights? So, we'll give you an immunity." So, on the one hand, there's better causes of action, but there's a lot more immunities. On the private side, you know, we really have an ongoing struggle against these click-wrap licenses and other kinds of things where they'll say that you consented to their business model, and that's a whole kind of different set of problems. If you can get around those, you can actually get some good accountability, but they're pretty powerful. So, in some ways it's just like they're just two different sets of obstacles to accountability. And I'm not sure, on some days we do better on one and some days we do better on others. It's really, you know, you just have to keep pushing in all directions.

I think for a while courts were very willing to just think that those things were contracts and that they should bind people. More people have recognized, including judges, that that's not the same thing as consent. Nobody, you know, it's not like I sat down with Google and had a negotiation with them about how much data they would have in exchange for being able to use a Gmail account. Like, that isn't, this is not a contract. Lawyers call them contracts of adhesion. And that should mean that their ability to enforce them is much less because they're not fair, and they're not negotiated with a fair negotiation. So, we've seen courts increasingly willing to not stand on those, but it's a mix across the country and in different jurisdictions. And so far, the Supreme Court, honestly, the Supreme Court has been unwilling to recognize privacy harms as harms.

Regardless of whether they come up in the corporate or the governmental context, in ways that are a kind of an overarching problem. Unless you've lost money or property, they tend to say, you know, nothing happened. And I don't think that's people's lived reality either.

Not fully.

I mean, I think it's actually not hard conceptually to think about what a law might look like to get at this problem. There's a couple of different ways. Lots of scholars have mulled this over. There are two that I am very enamored of because I think they would do. One is we ban secondary uses of data. Right? If data is collected for one purpose, it cannot be used for a secondary purpose without a very high standard that is not a click box, right? Like, you know, there might be situations in which, you know, you had a test done and now you want to use the test results to do something else or things like that in medical or other kind of context. I mean, that's okay, but I think that right now, this whole business model is based on secondary uses of data, right? You use Facebook because you want to talk to your friends, and Facebook takes secondary uses of that data to feed into the surveillance business model in the secondary markets. This is an old principle. The, you know, fair information practices and principles, FIPs, is something from the 1970s. And saying that secondary uses of data are a privacy violation, like, way predates the modern internet. And if we just brought that principle up and wrote a law that said that, we could cut the knees out from under this model. Not immediately, but, you know, the most valuable data to any of these companies is current data. Old data is not all that useful. It has a very short shelf life of being interesting. So, we can cut it off now, we can make it slowly less useful. That's one way to go about it.

The other way that people have talked, I think that would survive the First Amendment, because there's lots of, you know, again, we'd be in what I would think of would probably be intermediate scrutiny land, and that between trying to protect people's privacy and what we would be doing would be great, and it's not about content. I think that similarly, there's a bunch of ideas for something called fiduciary duties for people who hold our data, which means that they have an obligation to us to only do things in our interest with the data. This is like when you go to see me as a lawyer, I have a fiduciary duty that you can tell me the truth about everything that you did and I can't use that information for any other purposes other than to defend you. Accountants have the same duty. So, we have these duties in other areas. We could say that people who hold your data, your sensitive data, are fiduciaries to you and they have a duty to only use it in your interest. And there are ways in which we could write something like that that I think would survive real constitutional review and will work. Those are only two ideas. Like, the problem here is not how do we do this? The problem here is getting the political will to actually pass these laws and write them in ways that will really work. And so that's where our attention ought to be. Again, I think there's probably eight other ways that smart people could come up with that we could deal with the data broker problem. Those are two that, because they're both kind of sounding in the law and the way that I understand the law would understand, we could do pretty easily. So, I think that would make essentially most of what data brokers do illegal, or at least much, much more narrow. And that's what's fueling so many problems in our society. It really comes down to things that are being fueled by the surveillance capitalism, surveillance business model.