Good morning. I'm Justin Hendrickx, editor of Tech Policy Press. We publish news, analysis, and perspectives on issues at the intersection of tech and democracy.
Today's guest has spent 30 years in the front lines of one of the defining battles at the intersection of technology and democracy, privacy and the fight for who controls your digital life. Cindy Cohn is the executive director of the Electronic Frontier Foundation, or EFF. And she's been in the room for some of the most consequential fights over digital rights since the internet became part of everyday life. From legal battles over encryption in the 1990s to the NSA mass surveillance revelation, to battling FBI gag orders that kept Americans in the dark about government data requests, and now for the fight against the grave civil rights and privacy abuses of the Trump administration. Now as she's preparing to step down from her role at EFF, she's telling her story and trying to recruit a new generation to the fight. Her new book, Privacy's Defender, out March 10th from MIT Press, weaves her personal journey with legal battles she's fought on behalf of whistleblowers, researchers, innovators, and everyday people. Let's jump right in.
My name is Cindy Cohn. I am the executive director of the Electronic Frontier Foundation, and I am the author of Privacy's Defender: My 30-Year Fight Against Digital Surveillance, which will come out from MIT Press soon.
Cindy, it's a pleasure to have you here and I'm excited to talk to you about this book. And this is the first time I've had the opportunity to have you on this podcast. So, I think my listeners are probably well familiar with the Electronic Frontier Foundation, well familiar with your work as an organization. They may not know so much about you and certainly about your path. So, I want to kind of get into that just a little bit before we get into some of the issues of the book. I want to talk about the Iowa origin story. You open the book in a San Francisco courthouse, but you talk about how your kind of thinking about these things started in central Iowa. You describe feeling like you didn't quite fit in, the adopted kid, the Jewish family in a mostly Christian town. You talk about your mother's illness, your parents' messy divorce becoming fodder for gossip. You write about all that in terms of childhood perhaps being an education in what privacy is for. Did you see it that way at the time or only in retrospect?
I'd say it's mainly in retrospect. In writing the book, I tried to pull out the things that I think were formative, but overall I had a really fun, easy childhood. Again, these things were not absent, but everybody has stuff. I think in deciding that privacy was really important later on in life, I did try to look back and figure out like where did those seeds come from. I think most things that people are passionate about have some seeds in their history, and so I tried to pull them out here.
Talk about Mr. Leuen, this kind of pivotal moment that you portray in the book. Tell me about Mr. Leuen and the situation that you were in and how this individual came to your aid.
Yeah, by the way, I use pseudonyms for everybody, but Mr. Lu was my best friend's father growing up, and he was a lawyer. And I tell a bit in the story, he really is my inspiration for becoming a lawyer myself. But I largely thought that because unlike my father, he was available to take us water skiing in the summer. And I thought that was a better job than the one my dad had, as a traveling salesman who wasn't around a lot. I did learn a little later that water skiing doesn't come with the JD. And I might have been a little wrong about that as a kid, but when I was in high school, there was a wave of evangelical Christianity that kind of came across my high school. And this happened in a lot of places in the middle of the country in the early 80s. It wasn't unique to my little town, but I really started feeling like I was being targeted for conversion by kids I'd grown up with my whole life. And I really rebelled against that. We weren't a particularly religious family, but we weren't Christian. And that had been okay when I was a little kid. And suddenly I was being treated as if I was somehow broken and they were there to fix me. And that was not okay with me. And then I started looking around and realizing how much of what was going on in the little town was really based in the presumption that everybody was Christian. And most importantly in the incident that happened here, I was in choir and I'm still a singer. And we had to perform a lot of religious music. We had a Christmas program every year. It was almost always completely Christian music and some of it quite religious, not just the Christmas carols and things like that. And then we rolled around to Easter and we were supposed to do a whole program of religious music in a local church on Easter Sunday. And I felt uncomfortable with that. We were practicing and I felt like a fraud and it seemed to not be noticed by our choir teacher. So I went to Mr. Lu, who is a lawyer, and I said, 'I'm not really comfortable with this. Is this okay?' And he said, 'No, it's not okay.' So the first thing I did was I went to the choir director and I said, 'I'm not really comfortable with this. Can I skip the concert?' And he said, 'No, you're graded on performances and your grade will go down.' I was a good student. I wasn't going to let my grade be impacted by this. So then I went to Mr. Lu and I asked him what he thought about the situation and he said, 'No, that's not right. The Constitution, the public school shouldn't be making you sing in a church if you're not comfortable with it.' So he went and talked to somebody. I don't know that I know exactly how he did it, but all I knew was later he said, 'Don't worry, you don't have to sing in the church and it can't impact your grade.' And I just felt this rush of relief and gratefulness and this idea that somebody had stood up for me and protected me against the school is pretty powerful when you're a kid. And that feeling was really one of the moments when I think back on and I think about how I decided not just to be a lawyer but to be somebody who really stood up for people with less power.
Well, I'm going to fast forward now to San Francisco, 1990. You do a fellowship at something called the UN Center for Human Rights in Geneva. You wander back to San Francisco. You're throwing a housewarming party and this fellow shows up in tie-dyed socks that turns out to be, I suppose, an important connection.
Absolutely fundamental. The person's name is John Gilmore and he was one of the founders of the Electronic Frontier Foundation, but really I met him because he showed up with a bunch of hackers in my living room and one of the other guys who came to that party I ended up dating. But meeting John and these people who were, remember this is 1990, so this predates the World Wide Web. These are people who were living in a version of what most of us have all the time now with instant free communications with people all over the globe in an ongoing way. I remember in 1990 you had to save up money to have a long-distance call and again I'm older. This may be lost on younger people but counting the minutes that you could stay on a call before it got really, really expensive. It's just a whole different level to be able to have ongoing kind of distance-free communications and these guys were doing that and I just thought it was amazing.
A few years later, he calls you, says there's a grad student at Berkeley who the government is threatening to jail, apparently for publishing math. Tell us about this. What does this become?
Yeah, this becomes a case called Bernstein versus Department of Justice. So, the math PhD student is a guy named Dan Bernstein. He lives in Germany now. He's still a professor, but he was a PhD student at the time. And John calls me and said, 'There's this grad student. He wants to publish some computer code on the internet, and if he does, he'll go to jail as an arms dealer.' And I said, 'What does it do? Does it blow things up?' And he said, 'No, it keeps things secret.' And I was a baby lawyer at that particular time, but I said, 'That sounds like a First Amendment problem to me.' And he said, 'Me too. Will you take the case?' And this really introduced me into the world of what was actually going on on the internet much more deeply than my boyfriend and his friends chatting at all hours of the night on black screens with green letters. So John explained to me a lot more about what was going on with cryptography and how science was developing through internet publication. They were pretty far ahead of the rest of us because the universities and the government were hooked up rather than scientific ideas being published in papers on paper that were then sent around in magazines. It was being published in an ongoing conversation online. And one of those places was a newsgroup, which for folks who might be a little younger, it's kind of a decentralized version of what now might get on Reddit, right? Little forums that have topic areas where people who are interested in stuff can sign on and communicate. Again, Reddit's owned by a company and this is much more distributed. It was an organization called Usenet that managed this and Dan wanted to publish this little computer program and indeed the US government had export regulations that said that if he didn't get a license to do this, he could go to jail as an arms dealer. On the US munitions list, which is the list of things you can't export without a license, there are things like surface-to-air missiles and tanks and software with the capability of maintaining secrecy. And that is what Dan wanted to publish. So I took on the case. I went to my little firm. I was at a small firm in San Mateo at that point, and I convinced them to let me do this case pro bono. And we set about to try to figure out how to make it so that a math student could publish his work online and not have to get a license, and the government wasn't handing out licenses to people like Dan. So the idea that he had to get a license wasn't just a hoop he had to jump through. It was actually a barrier. And so we put together a First Amendment challenge to the arms export control regulations, ultimately called Bernstein versus Department of Justice, and set about to get this hurdle out of the way of all of us having access to strong encryption because I knew and we knew that this was going to be a key to us having privacy and security online. It turns out that encryption is really one of the ways that you can build privacy and security in digital communications and there aren't very many others. It's really very central.
This kicked you off, this started your path and of course now I suppose you've looked at these issues around privacy, around the relationship between the state and individual freedoms and rights in more ways than you'll probably, you've probably forgotten more details about this particular intersection than I'll ever know. But I want to kind of maybe just abruptly bring it to the present moment and ask you a little bit about where we've got to in this country. I mean, I don't know. I kind of feel in my core that just the last few months, you know, what we've seen in Minneapolis, what's happened on the streets there, you know, some of the movements of the federal government against members of the press, some of the other kind of major infractions around privacy and privacy law from the Trump administration, things like the Department of Government Efficiency, pooling data in ways that before were kind of thought to be, I don't know, illegal.
Totally illegal and inappropriate, right?
I don't know. Where's your mind now as you cast it across that arc from that point where the fight started for you to where we are right now?
I have good days and bad days. I think like anybody who is engaged in these battles, I would say on the bad days, I feel a little like Cassandra, the Greek goddess who was always screaming about the terrible things that were happening that nobody else could hear. And that we have been screaming about the potential that all of this surveillance and lack of attention to security could end up really empowering authoritarian governments since the 90s. This was our worry. A little later, Ed Snowden came along and called it turnkey totalitarianism, which is a phrase that I think is pretty apt. That we set up the structures by which a government like the Trump administration could come and really turn up knobs that were already there and create a much more authoritarian state that the rest of us would be stuck with and would have very little power against. I think of privacy not as something like a tarp you put over your head before you do something illegal, but more a check on power. It's how we protect ourselves against an authoritarian government. It's also how we protect ourselves against business models that are aimed at violating our privacy. It's not either or. Sadly, we don't get to pick which one we think is worse. We have both and they are feeding each other. In the worst of times, I feel really sad and despondent about how bad it's gotten and that the things that we have been advocating for for a very long time, if we had actually taken steps as a society to really implement them, it would be a lot harder for the Trump administration to do some of the stuff they're doing now. On the other hand, when I'm on my more optimistic days, if we didn't have access to strong encryption, we would be much worse right now, in a much worse position, if we didn't have the privacy laws that we do have. We would be in a much worse position. I am on more Signal conversations than I can count. And they aren't just with security people anymore. They're with people in regular society who have recognized that they want to stand up against this government, but also that they need privacy in order to do it securely in a way that protects them and their loved ones. Privacy is a team sport, right? Sometimes people think about my privacy. I don't have much to fear. I'm not really likely to be a target. And that's really not the right way. That's not how the government thinks about your privacy and it's not how you should think about your privacy. It really is who are the other people who you're communicating with? Who are the other people who are in your rolodex and your files and what are their risks that you have to think about because that's how the government works. They use contacts. The NSA calls it contact chaining to get to the people that they're actually targeting and also to do these kind of wide swaths of things like ICE raids. They try to figure out where a whole bunch of people are that they can do together. So, I think that on my happy days, I'm glad that we have the things that we have. And I know that we would not have had them had it not been for the fights that we did going back to the 90s. And on my darker days, I look, some days you look at the road behind and some days you look at the road ahead. And depending on which one you're focusing on, you can feel better or worse. I think both things are true. The bad news is we have a lot to do. The good news is we have solved harder problems as a country and as a world than the danger of a surveillance state and a totalitarian government. We have done this and in the United States we've fought harder problems and around the world people have thrown off authoritarian rulers before and made it to a better world. So those are things to just keep in mind so that we don't end up in despair because despair serves the powerful. It's what they want. Because if you're in despair and you're just sitting around feeling bad about things, you're not organizing, you're not strategizing, you're not building community with other people who agree with you. And so just as a, again, I'm probably more of a strategist than anything. Just as a strategy, don't let those guys win.
I hear you saying, you know, fighting over every inch matters because you never know, you know, what room that will give to someone else to continue the fight. Let me ask you specifically about what EFF is doing around what we've seen in Minneapolis and what we've seen, you know, in the ICE CBP vein in particular over the last few months. What's ongoing?
Lots of groups are doing a lot of good work around ICE and most of the center of the work in Minneapolis is done by people in Minneapolis. But what we are trying to do is we have been mapping surveillance all across the country for a long time. From the Atlas of Surveillance, which is led by a couple of my colleagues, including Dave Moss, it's an attempt to try to give people information about where surveillance is happening. We've specifically started actually down at the US border in the south because there's so much surveillance there and that ends up being the test bed for a lot of things that get rolled out everywhere else. We have worked a lot on issues around protecting people's data privacy and trying to stop data being collected in one part of the government from being used in other parts of the government. People who follow this stuff may know that the president issued an executive order on data silos saying that data silos need to end and that the government needs to have access to information across the government, not just in the particular areas. This really violates some things that have been sacrosanct in the law, like you should tell the IRS the truth and that data won't go anywhere else. We know there is an effort right now, it's in the courts. There was just a decision that came out today that I haven't had a chance to read yet on whether ICE can have access to IRS data. There's new reports coming out of some of the trials, one in Oregon specifically about Palantir, a company providing a tool to ICE agents locally that incorporates Medicaid data in some way to help them identify where they're going to do their raids. So those are, and then overall the thing that EFF always does and has done for years and years is we have surveillance self-defense materials up on our website that both we use to train people in security when they're engaging in protests or activism or journalism or crossing a border, but also that are used by lots and lots of people who do security trainings who aren't us. We tried to build tools that are scalable such that you don't have to be, compared to the size of the problem, we have a very small staff. We tried to build tools that are helpful for people all across the country and around the world to be able to train people in how do you use Signal? What do you do if you have your phone at a protest? How do you evaluate the risk to you and others and make intelligent choices based on what security people call your threat model? So, some people might not want to take their phone to a protest. Other people might want to take their phone to a protest, but turn off the biometrics, the facial identification. Due to a weird quirk in Fifth Amendment law, your face can be used and your biometrics can be used to open up your phone, but requiring you to put a password into your phone is harder for the cops and we would argue requires a warrant. And this is a fight we're in all across the country, but right now that means you're a little safer if you turn off the biometrics. Decide whether you want to take pictures, think about how to maybe scrub the, some people may want to scrub the identifying information that automatically happens with pictures. Other people might want something that can be used in a court of law and so they're going to want to keep that information that the phone logs about where you were. So these are all things that again we try to make resources available in things that we internally call playlists to help people evaluate who they want to be, what risks they want to undertake and make the right decisions for them because there isn't a one-size-fits-all answer to this. And we really tried to bring that into the conversation. I know that there are people who want four simple rules to attending a protest. And you can go so far with that, but generally you have to presume who that person is. And most of those rules are presumed based on people who are upper middle class white people who are not at great risk of being targeted. And those aren't the right rules for many, many other people. And most of us probably have somebody in our phone's rolodex who is at much greater risk than us. And you have to think about that in terms of what are you taking to the protest, what are you doing, and how are you doing those things. So that's a long answer, but we're doing a lot. And then just being a resource as we run a legal referral network. People especially with digital issues can reach out to us and we will try to connect them with lawyers even if we can't help them. We tend to do impact cases, meaning cases that if you take on will make big changes in the law or policy as opposed to small cases which can be very, very compelling. So we try to find everybody counsel. We help advise coders who are developing tools, things that might be used to track ICE or otherwise. We have a set of lawyers who are specialized in trying to help people who are doing those kinds of things. And then we try to help contextualize what's going on. And we participate as amicus. Anyway, it's a whole range of things because we are an organization with activists, lawyers, and technologists, and we're working in all of these domains in ways that we can best be supportive of honestly the frontline people who are on the ground handling these situations.
