What Is Digital Privacy? Cindy Cohn Explains the Fight for Your Rights Online

The couching of long-term vision in short-term greed is fairly obvious right now. A lot of this is couched in defending Western civilization. I don't think you defend Western civilization by dehumanizing people, by throwing them in detention, by taking away their rights. I'm not sure if they're fooling themselves, but they're not fooling many people who have kind of steeped themselves in the real world work to try to help lift up everybody and give everybody dignity.

Right. Well, we try to give them a run for their money, you know?

Well, they shouldn't be because I'm leaving EFF because I wanna get a little closer to the fight than you can be as an executive director. So I'm not done, I'm not done with them because they're not done, right? You know, like, if everything, if nothing needed fixing, then I could go off and do something else. But no, I feel like, especially now, a lot of the things that I warn about in the book are really happening at a pretty unprecedented speed and size. So no, part of the reason I'm stepping down is because I wanna, I miss those days. I wanna get back into the fight at a level that is pretty hard to do when you're the executive director of a 125-person organization, even one as great as EFF.

Not yet. I'm talking to a bunch of folks. There are several options on the table. I'm trying to figure out what the best fit is. And I'll make a decision probably later this spring, but I'm, you know, the first job was to make sure that EFF was in good hands, and I'm feeling really comfortable about that. They're at the very end of their search, and I'm very happy how that's gone. So I wanted to get EFF buttoned up before I really turned in earnest to what I'm gonna do next. But I've had lots of conversations with a lot of people and something fun will come out of it.

You know, one of the things that we, you know, you do when you're an impact litigator is you definitely, you know, that that's a very different posture than being a politician, you know, where you try to make everybody like you. I mean, I certainly try to be nice and kind, but it's not my job to make everybody feel good.

Yeah. Many people listening to this will probably not even know what we're talking about here. EFF was founded in 1990, so we predate the World Wide Web. So the internet was really made up of a lot of academics, people who were in government, and a few people who were kind of learning how to play online. And I talk a little bit about one of the early networks called the... Well, most of the people involved in this knew that the internet was gonna spread, but they didn't exactly know how. And we started to see the government really, some of its policies that were created in an earlier time just weren't working in the digital age. And then in other situations, we kind of felt like the government was taking liberties with the new technology, or at least didn't understand it. And EFF was founded because of a series of Secret Service raids on people who were engaging in early internet conversations. Think of the kind of early version of Reddit, right? Where there's these open forums where people can talk. It wasn't owned by one company, but that was kind of the experience of a user of some of these newsgroups. And then the Secret Service would show up and they would, you know, seize everything that was plugged into the wall. They nearly bankrupted a little company called Steve Jackson Games, which is a game company. It still exists right now out of Austin, Texas. And, you know, John Perry Barlow and Mitch Kapor and John Gilmore, and later Steve Wozniak, you know, was one of the early funders, kind of realized that there needed to be a pretty strong voice on the user side, making sure that things were, you know, that we really protected people's rights as we moved into this digital age. And they founded the Electronic Frontier Foundation to do just that. And, you know, the story that they tell is that, you know, early on, they wanted it to be a fund. It's called a foundation, but it's not actually a foundation in the way most people think about it, because they thought they were gonna raise money and hire lawyers to help some of the people who were involved in this. And they couldn't find any lawyers that knew enough about the internet to really do this. And so we kind of started growing our own. And that's why the organization at this point really has a pretty full slate of lawyers and technologists and activists all aimed at this. But it started because, you know, in the early 1990s, there just weren't a lot of lawyers who knew enough about digital technologies to do this. But, you know, the hacker culture was deep in the early internet, you know, and to be on the internet at that particular point in time, you had to be fairly technical. You had to be able to navigate your way around, you know, systems, and really, you know, a kind of basic hacker mentality is to try to like do something and not realize there isn't a tool really to do that thing and then decide, well, you're just gonna have to build it yourself and then give it back to everybody else. And that's, you know, that kind of spirit still exists in the internet, but it's a little overshadowed now by this idea that like four large companies decide all the things that we get to do. And if they don't want a feature, you don't get it. And I think that's too many people's experience of the internet now. And things were better and are still better in the pieces of the internet where people really kind of take ownership of their reality and are willing to dig in and build it and then offer that to others.

I mean, it's so hard to know. I don't think so, because I think that where we came from was really about empowering the end users, not about scaling and blitzscaling gigantic companies. And I think that in some ways the voices that we tried to lift up were very different voices than the Peter Thiels. I think that there's a philosophical difference. Again, I don't wanna paint them all with one brush. But, you know, I think that the idea that it's important to lift up the people who are alive today as opposed to some kind of theoretical future, you know, is really where EFF is grounded and where the founders grounded us, right? We are a civil liberties organization. We care about who people are today and what they're doing today. And I think there's a lot of some of those Silicon Valley people were really kind of convinced themselves that today didn't matter and that, you know, some kind of theoretical future people, you know, since there's more theoretical future people than people alive today, we ought to use cost-benefit analysis and decide there's more benefit to those future unborn people. And I think there's a bit of kind of dorm room sophistry at the bottom of all of that, right? It's not, you know, I'd rather help the people who are alive today, and I think those are the people who, that is kind of EFF's founding ethos. We're a little closer to, you know, to the people who built human rights than we are the kind of Silicon Valley people. And we tried to bring some of that, you know, I feel a lot closer to the Eleanor Roosevelts than the Peter Thiels in terms of my approach to thinking about these things.

Well, look, they're all people who've had a lot of power and had to decide what to do with it, right? And, you know, one of them tried to build international structures so that everybody could have rights and liberties, and others have, let's just say, made some other choices about where they wanted to put their, I mean, their power.

The couching of long-term vision in short-term greed is fairly obvious right now. And I just think it's important to kind of like try to be clear-eyed about, you know, what's happening. I see a bunch of these days. I think right now a lot of this is couched in defending Western civilization. And, you know, I don't think you defend Western civilization by dehumanizing people, by throwing them in detention, by taking away their rights. Like Western civilization, no matter, you know, is not about that. But when something gets clothed in it, somehow people think they're talking on a higher philosophical level. But, you know, human rights, that's why I prefer the human rights framing over the Western civilization framing, because I just think it's kind of phony and I'm not sure if they're fooling themselves, but they're not fooling, I think, many people who have kind of steeped themselves in the real world work to try to help lift up everybody and give everybody dignity.

But I think that's right. I mean, again, I come from a classical educational background. I was an English major. We read all the greats, and I don't think any of them were talking about throwing people in concentration camps and detention centers and lifting up people based on their skin color, you know, as superior intellects. Like, none of that is what I think those people were about. And I really think that it's important to look not just at what people are saying, but what they're doing. And when you look at what's happening right now, it's contradictory to, you know, why EFF was founded. But it's also contradictory to, I think, a lot of the things that they're claiming they're trying to do.

I think it's so, and that's so wrong too. You know, EFF, you know, John Perry Barlow and John Gilmore, they're libertarians. Barlow was especially a libertarian. He felt like human consciousness and human beliefs, you know, were freer when there was, when we were very careful about what the government, what power the government had. That is a legit way to think about human rights and liberties. And I think it's a cons-, it can, it's completely consistent with a conservative viewpoint. I think that the, you know, I think for a lot of, a lot of what's sad for me right now is that the kind of what I think of as a classic conservative mindset, which is, you know, what role should government play in people's lives and how do we best lift up everybody? Is it with government, you know, the risks of government intervention versus the risks of government non-intervention? That's a legit argument to have. Signing up to some guy as your king isn't conservative.

Yeah, I mean, you know, one of this is one of the ways in which the government approach to technology kind of just had to change over time, right? Encryption is old. Caesar had a cipher. The founders of the US, you know, Jefferson was in Paris and Adams was in London. They had to talk to each other in a secure way. They used encryption, right? So the government kind of thought of encryption as something around military and governmental affairs. And so encryption was on the US munitions list next to surface-to-air missiles and tanks when we started in the nineties. And that, you know, that was understandable in an earlier era. But one of the things that the founders of EFF and John Gilmore was very central to this knew was that we were gonna need to have privacy online. We were gonna need to be able to control who could hear what we were saying to each other if we were gonna have rights online. And so these encryption regulations were in the way. Bernstein versus Department of Justice was a case that the EFF approached me and asked me to take on. I was a young lawyer to try to get rid of those encryption regulations so all of us could have privacy online. The tool of privacy online is encryption. It's also the tool for security online, it turns out. And so they asked me if I would take on a case. And the way that these encryption regulations worked was you needed a license before you could export encryption from the US. But export means putting it in a place where a foreign person can get it. And of course, everything you do on the internet, you know, is amenable to foreign people seeing. And in fact, that's how the science of cryptography developed in the nineties, is people sharing ideas back and forth online. And so we put together a lawsuit, actually, I mean, they presented it to me already. It was already being developed for a math PhD student named Daniel Bernstein. He was a Berkeley PhD student who wrote a little encryption program and wanted to publish it online as part of this conversation about the science. And the way the regulations worked, if he did that without a license, he would go to jail as an arms dealer, which is a very, very serious offense. And, you know, when John Gilmore called me and said, would you, would you, I said, well, what does this program do? Does it like blow things up? And he said, no, it keeps things secret. And I said, well, you should be able to publish instructions about how to keep things secret online. That's a First Amendment problem. And he said, well, we think so too. Will you take the case? So we did. And the way that we argued this was really based in science. You know, the publication of scientific ideas has always been protected under the First Amendment. It was very clear even in the early 1990s that some scientific ideas are published via code. That coding is a way to be very precise about how to do things, especially more like a recipe. We use the analogy of a recipe a lot. So, you know, coding breaks down a problem into little teeny pieces that are small enough ultimately if you compile it for a computer to be able to do. So what we said was, look, this is how science happens and the science of cryptography is a real science and we need to protect it, and the First Amendment needs to protect the publication of this code. And so code is speech for sure, but really in this context of the ongoing development of science, it was a very, very strong, I think, both metaphorical and practical argument. And we were successful with it. The lower court and the Ninth Circuit both held that the publication of Dan's code was speech for purposes of the First Amendment and that the regulations didn't protect it. And then ultimately as we were making our way up through the courts, the government actually backed down. And so we didn't get the clean win that we wanted. You know, as a lawyer, I like a clean win, but we actually got encryption freed, and that's part of the reason why we all have encryption in all of the things we do online now. And it's available to us.

Well, I think the internet wouldn't be a place where you could have any kind of private conversation, you know, tools like Signal and WhatsApp that a lot of people are using these days to do, you know, everything from communicating with their loved ones to political organizing. You know, the web itself is encrypted now and that's some work that EFF and our friends at an organization called Let's Encrypt. So that when you, you know, type in, you think you're going to your bank, you know, to do a transaction, you're actually going to your bank. So there's encryption that you might not see, but it is on the back end of this that makes the internet secure. Because otherwise people can get hijacked really easily and some people still do get hijacked, but it's much better than it would be. So whether you're doing transactions or, you know, surfing the web, getting access to information, any of those kinds of things, they really wouldn't be possible in anything like a trustworthy way if we hadn't freed up encryption.

Correct. That's what the S stands for, I believe, is secure. Right. Hypertext transfer protocol, secure. I might be wrong about the S, but yeah. And, you know, the early internet was HTTP, and we have slowly worked, and the EFF had an actual tool that we used for a while called HTTPS Everywhere that would help things present in HTTPS, but now it's built into the browsers. Most of what people do browsing is HTTPS because we were able to get the security, you know, turned on in the protocol and used in most of the internet.

Yeah, I think that it definitely was an amazing victory and it was important and lots of people helped. Like, I mean, I was able to sit at the front of a fight, but there were other people doing a lot of work on it. But yeah, I do feel like, you know, I got my first chance to play in the big leagues and we were able to win. And, you know, the sad part about it is we keep having to defend that win. Right. You know, right now the UK and Australia are very hostile to encryption. The US, you know, periodically there's efforts to try to break encryption. We learned from the Snowden files that the NSA, once they lost their regulatory authority through the export regulations, started going, you know, kind of in the back door and weakening encryption. So on the one hand, we won this tremendous victory and it was a huge victory and made a big difference. On the other hand, it feels like I've spent the last 20 years since trying to defend what it is we stood up for, which is the right to have a private conversation online.

No, absolutely not. They very clearly rejected that theory. And, you know, what they found was that there were communication problems between the NSA and the FBI and the various government entities. But the big thing was that, you know, something called groupthink, right? That the people at the top, including George Bush, remember Bush was warned that Osama bin Laden was gonna strike inside the US, right? They just couldn't take in information that was inconsistent with their worldview. And this is a psychological phenomenon that people are, you know, has been studied. But so no, it wasn't about the lack of security. It wasn't because they were somehow limited in their ability. You know, the things that they do to protect our rights limit some of the things that the government can do. Those things weren't what the 9/11 Commission found were the problem.

No, I think that's true. I think that, you know, sadly, you know, they were able to really, and, you know, some of this happened, the 9/11 Commission happened a little later than a lot of the laws. Right. The Patriot Act was passed right after 9/11. The Commission came out significantly later, and the Congress rushed in because they were frantic to do something because, you know, the attacks were horrible and clearly things had gone wrong. And a lot of the things they did were things that the FBI and the NSA really had wanted for a while. But they didn't map to the problems that the 9/11 Commission found nearly as closely as I think people would hope, or that a lot of people think. A lot of people, you know, because we felt insecure as a result of the attacks, which were terrible. Anything, you know, that said that it was gonna bring us security, you know, got a lot of support. And it, you know, you and I were both, you know, adults during this time. I think a lot of people now might not remember it in the same way that we do, but, you know, making people feel more secure was a government priority. Whether it actually made us secure or not seemed to be not nearly as important as the story they were telling.

Oh, we can definitely have both. And again, this is a point, and the 9/11 Commission didn't find the thing that made us unsafe was the civil liberties and the security things. It found that there were other things. The thing that will make us most secure is if the people at the top of our country actually believe it when analysts tell them there is a threat coming, instead of not believing it. You know, there are things that we can do to make ourselves more secure. I think the number one was, you know, putting doors between the cockpit and the rest of the plane. Like, that is a very significant difference, right? And something that actually has, you know, good data behind it about, you know, making it a lot harder to hijack a plane. So there's lots of things we can do that make us secure. The problem is that not everything that goes by the banner of making us secure actually makes us more secure. And for many of those people, those things, our rights are what we give up. There's a thing that we lose in exchange for this false promise.

No, I'm saying that real security is consistent with real security. Yeah. That there's plenty of things you could do that are real secure that do not undermine our civil liberties or our privacy and that those ought to be the things we do first. And I'm really, I think, secure, I think privacy and security go hand in hand. You know, on a technical level, encryption does that, right? Encryption gives you privacy. It also gives you security. They quite literally are the same things. But I also think for, in terms of protecting our rights, those things go together most of the time as well.

Yeah. Well, I mean, I think that this is one of the other pieces that's hard for, I think, people to reckon with is that, you know, there's a lot of road between technically surveilling everything and actually making that information available to people. And we've seen this with police body cams is another one where, you know, in theory, that ought to give a lot of accountability to the police. But what ends up happening is it really doesn't. It's very hard for defendants to get a hold of it. It's very hard. You know, the cops take a look at the footage first and then conform their stories to what the footage shows. So it ends up helping them mislead the public about what they're doing. So you have to look both at the technology and at how we're using it. And I think the Epstein files is a good example of, you know, there's tons and tons of these emails. It's not like there wasn't a pretty strong trail, but yet getting them out in a way that both protects the victims and identifies the things that we as a society need to know in order to make judgments based on it, we're still fighting to make that happen. So it's one of the things about mass, I think people think sometimes that mass surveillance will automatically make us safer, and it's far more complicated than that. And I think in many instances it doesn't. And again, you have to look both at does it make us safer and what are we losing as a result of it? And, you know, we just had an incident with the Ring doorbell cameras, right, where, right, Super Bowl, where people saw in the Super Bowl commercial this idea that, you know, Ring doorbell cameras can help find a lost puppy. And I'm a big dog lover. I mean, it pulled on my heartstrings too, but I think immediately people saw, you know, what else can you track through a neighborhood? And do we feel comfortable that our law enforcement and ICE will never misuse this mass surveillance technology in ways that harm us or our neighbors? And I think people, you know, part of what happened there was there was a huge percentage of the people who saw that ad who immediately made that connection and said, this mass surveillance isn't gonna make us safer. We don't want any part of it. And, you know, as a result, Ring dropped, you know, the arrangement it was making with Flock, which is a company that does mass surveillance for license plate readers, and basically said, we can't do this. People are understanding how this mass surveillance can be misused at a level that surprises us.

And, but I do think that sometimes people get so caught up in their own stories that they really can't see the reality. And we see this, you know, in the higher echelons of a lot of parts of our government and our corporate America sometimes. And it's, you know, it's good that there was a reality check, right? That enough people made enough noise that they realized that this wasn't landing in the way that they thought it was gonna land. But, you know, similar things going on now, you know, Meta is saying that they're gonna put facial recognition in their glasses that they sell to the public. And I think, you know, there was this kind of nasty internal memo saying, you know, this is a time when civil liberties groups that might criticize us are too busy with the Trump administration. And so they won't notice, which of course we immediately were like, ah, we noticed, you know, and we're gonna attack it. But I, you know, I think it's another moment where the people at the top of these organizations really are not connected with what's going on with real people on the ground who are gonna see that. Like, facial recognition in glasses is not gonna just be used for, you know, finding puppies. Right? It's gonna be used for the kind of mean anti, you know, detentions and civil liberties violations and discrimination that we're seeing.

Well, I just think that, again, you know, and it's possible that we do it as well, you know, it's easier to see this in other people than yourself, but you do, I think you get caught up in your own story, and it's important to have a range of people in the room or that you're talking to so that you're not so surrounded by sycophants and people who always agree. You know, the nice thing about being at EFF is like, we are not surrounded by people who agree with us, but the more power you get, the more that tends to happen. And recognizing that and finding ways to get a voice that isn't beholden to you to give you a straight answer is, I think, a challenge for anybody who gains a lot of power.

Yeah, I mean, you're correct that this 'Congress shall make no law' has meaning. It means that this is about the government. So, and it has been included to mean government regulations. So, you know, it doesn't have to be an actual law. It can be something, say, that the FCC does or the FTC does. It's how the government has to interact with us. And it says that the government can't restrict our speech except in very narrow circumstances. So yes, when a big company decides, you know, whose speech it wants to host and whose speech it doesn't wanna host, that's generally outside of the First Amendment. Again, the doctrine is big and complicated, so there are tiny little exceptions. But in the whole, you know, just like if you run a bar, you know, you get to decide, you know, do you want your, you know, you can't discriminate based on race, but you can say, you know, this is a bowling bar. If you don't wanna be a bowler, don't come here. You know, you can do lots of things that restrict who, how you get to control who you're hosting, right? And there's some famous First Amendment cases about a parade. And, you know, the people who organize a parade get to decide, you know, who gets to put a float in the parade, and that's generally not something the government gets to dictate. Or if you have a bookstore, you get to decide what books you put in your bookstore, and the government doesn't get to tell you, no, you can't put that book in. So these are all things where the kind of private nature of it means that the fundamental decision making needs to stay with the company. Now, so that's the first part of the First Amendment. You know, it doesn't mean, one of the things that sometimes people say is, you know, it says Congress shall make no law. That means no law. And, you know, traditionally that hasn't meant zero. What it's meant is that there's a very high standard for when the government gets to regulate in ways that impact speech, and that there has to be a very close fit between what it's saying it's doing and how it actually works. And they call it strict scrutiny or intermediate scrutiny or rational basis. There's levels depending on what the government says it's doing. A lot of what the First Amendment requires is for it to be actually doing that and not having a lot of side effects. So, you know, the government saying, well, we just wanna make sure that, you know, there's no criminals on, you know, on the internet. So therefore everybody has to, you know, show their ID before they go online. Well, there's not a very close fit between having a government-issued ID and being a criminal. So that would be an example of something that doesn't have a very good fit between the means and the ends.

I think so. I mean, we're still waiting to hear the facts. Right. Did CBS do this voluntarily and basically over-censor Colbert? Did the FCC actually say something? We know in the context of Jimmy Kimmel a while ago that the FCC chair actually did say something. In this one, I think we're still trying to understand whether, you know, CBS News, CBS, which is of course, you know, Barry Weiss and now really controlled by some people very friendly to the president, whether they self-censored or whether they were actually censored by the FCC is something that, you know, again, this just happened yesterday, so we as a factual will come out. But either way, it's a problem. It's a problem if the rules are so unclear.

Uh, that self-censorship happens. Um, that's a vagueness is a doctrine in the First Amendment. So if the, the government, even if the government doesn't directly threaten, if it, it writes its rules so unclearly or so broadly that it causes self-censorship, that can be a First Amendment problem, or this isn't about the First Amendment at all. This is about CBS News kowtowing, because it's trying to go unbended knee to, to, to Trump. And that, that's the piece that I just can't tell yet.