Cindy Cohn: Privacy's Defender

You know, when I look back on my career and I thought about, you know, what are the things that I've done that have affected or helped the most people, I just don't think anything comes close to bringing up encryption in terms of the impact. But also, as mentioned, it's not just about me, which I'm, you know, I'm very happy to tell the story. It was really fun to get to do that, but it's a story about kind of a ragtag group of, you know, hackers and activists who bound together, and, you know, lo and behold, we won. I mean, that's a narrative that, you know, is important for people to remember, even as I then, you know, I did tell two other stories in the book where the win wasn't so clean. And I think all of those are important for people thinking about how can we make the world better today. You know, sometimes you get clean wins, and sometimes you get messier situations, but the fights are always worth it.

Well, we didn't get into this because of one problem. It's not a one neat trick kind of situation, but there are things we could do to regain control of the internet if we had the political will and leadership to do it.

I mean, I did a little bit of work online when I was in law school, which would have been in the late '80s. You know, there was a Grateful Dead newsgroup, and I remember somebody pulling, making a tape for me off of that. I had a good friend who had been a computer science major as an undergraduate at the University of Maryland, and he was already online a little bit and was using, you know, command lines and things like that to do things. I didn't really get online until about '93 or '94 when the EFF asked me to do what became the Bernstein case, and I think my very first account was actually an AOL account because I was more interested in getting online than I was in the pathway there, and, you know, they sent you all these little discs in the mail. It was pretty easy.

But, you know, when did I start thinking about the revolutionary possibilities of this? Probably in early 1990 when I first met a bunch of the hackers who were out of the Free Software Foundation and MIT, and they were really using the internet in much more, you know, broad ways than I had in my limited experience. And that was when I really began to think, along with them, about what the world was going to look like when everybody else had access to this technology that kind of this very small select group of people had access to.

Yeah, I think I'm a little later than you, Andy. I'm earlier than most people, but I think I was later than you. You know, I think that that's wise and right, and I think people who come out of like history of media may have had an early glimpse into, you know, a potential darker future in a way that maybe others didn't. Look, I came out of international human rights. I got into and met some of these folks right after I'd spent some time at the UN Center for Human Rights in Geneva, Switzerland, and so I was thinking about how important it was for people all around the world who were suffering and struggling to be able to get their stories out, and how this technology was going to really revolutionize that ability. And I think that, you know, all things can be true. Multiple things can be true. I really reject the idea that we have to kind of make a thumbs up or thumbs down decision on every new technology, and then that guides everything we think about it. It's a mixed bag, and it has been a mixed bag. On the score of letting people who otherwise wouldn't have their voices be heard, you know, given the way media was structured in the 1990s, I think the internet's been amazing. That doesn't mean it's without, you know, I think that the people who are worried about commercialization, there's a quote from an early guy who was involved in the WELL talking about this point, Wendy, that like we just had to get freedom embedded before the, you know, forces that would turn the internet into a gigantic shopping mall got their hooks in it. I'm not getting the quote right, but it's something like that. I think those folks were not wrong either.

No, I was an outside lawyer. So, I worked at a little law firm in San Mateo, California from about 1990 till 2000. And it was only in 2000 that I joined EFF as an actual employee. So, I was working on encryption for about 1993 or 1994, but I wasn't part of EFF formally.

Yeah, I mean, I think that what's important to me in part about writing this book and revisiting some of this history, that, you know, you guys, most people I talked to about this didn't live through it with us in the way that Wendy and John, you did, but is because I think some of this history has been lost to the narrative that, you know, the early internet was just about founders, you know, guys in the businesses that they built. And I was getting frustrated with that narrative because, you know, not just in the personal, like it wrote me out of history, but also kind of more broadly that it led to this sense that there weren't people who were willing, not just worried, but willing to dig in and do work to try to set up a better internet. And I think as a result it's left a lot of kind of younger people thinking that maybe they're powerless and that there's nothing they can do. And so my big picture version of wanting to write some of this history that I did in Privacy's Defender is to kind of shine a light on the core group of people who were really working hard to try to build a better internet. And we didn't succeed all the way, but we also didn't lose all the way.

Yeah, I mean, I think it's kind of hard for people to imagine right now, but PGP, which was, you know, Pretty Good Privacy, it was an encryption program which was bulky and very hard to use, but worked, was kind of treated like an outlaw technology by the government. And as a result, it really limited people's ability to have privacy and security. And it was pretty quickly identified as one of the ways that, you know, one of the fights that we needed to win in order to have just basic privacy and security online. And, you know, the good news is we did win it. I mean, it's an ongoing fight, but, you know, we have Signal now. We're talking over Zoom. There's encryption built into a lot of Zoom. There's encryption built into our devices so that when you lose your phone, you don't lose everything that your phone connects to because the device will encrypt when it's turned off or turned down. All of that is a result of us winning that first fight. Now, again, I don't kid myself. We need a much more secure and a much more private internet, but when you think about where we would be if we hadn't won that fight, if, you know, basically using something like PGP was still so terrifying that big companies were afraid to do it, I think we'd be in a very different world, and I don't think it'd be a better one.

Yeah, I mean, it really was. It was a shadow that was cast over a lot of things, and so it was, you know, in many ways one of the very first righteous fights of the digital age.

Yeah, I did. I think that, you know, when I look back on my career and I thought about, you know, what are the things that I've done that have affected or helped the most people, I just don't think anything comes close to bringing up encryption in terms of the impact. But also, as I've mentioned, it's not just about me, which I'm, you know, I'm very happy to tell the story. It was really fun to get to do that. But it's a story about kind of a ragtag group of, you know, hackers and activists who bound together, and, you know, lo and behold, we won. I mean, that's a narrative that, you know, is important for people to remember, even as I then, you know, I did tell two other stories in the book where the win wasn't so clean. And I think all of those are important for people thinking about how can we make the world better today. You know, sometimes you get clean wins, and sometimes you get messier situations, but the fights are always worth it.

The first, the second one was about the NSA mass spying, and the third one was about something that's a little less known, which is national security letters, which are these subpoenas that are issued to the companies that provide us with services, telecommunications or internet or other, that have an eternal gag order. So when we started, anyway, the companies would get an order requiring them to turn over information about their customers, and they were gagged from forever telling anyone that they had done this and that they had received this process. The UK has an equivalent.

Yeah, there's many of them. In fact, the US actually, I think at this point, probably has a little more transparency than a lot of countries around the world around these secret national security processes. But we thought it was outrageous because there's no judge involved, right? They're just self-issued by the FBI. And without a judge, there's really no check and balance. And the thing that we discovered was that these national security letters were being used, you know, hundreds of thousands of times, involving the turning over of information about, you know, I think fair to project out, millions of people. Many of them, you know, required entire calling circles. So, everybody who called a particular number, and then they would often go outwards from that. And so, the numbers could get really big very quickly. And so, we worked, you know, we had secret clients in those cases. I couldn't reveal the name of my client for six years. And the secret client stood with us through these big fights to be able to tell the world that they were, you know, they were receiving a lot of these requests. And the information led to Congress scaling back the national security letters a little bit, not as much as we need, but significantly scaled back, but they're still a problem.

Oh yeah, absolutely. And I think it's important, you know, what's buried in this is like your conversations with ChatGPT or other large language models are not secret. They're not private by, I think, most people's scale of them, and they are increasingly being relied upon by law enforcement to try to make their cases against people accused of crimes. And I think that while there's some situations in which that's reasonable, there's a lot of situations that we should be afraid of. And I will tell you that law enforcement only tells you about the times that they succeed, and they don't tell you about the times that they fail or they prosecute the wrong person. And so people often get presented with these situations like the Florida shooter, which are terrible, and then that's used to try to make sure that the cops have, you know, ready access to this kind of information and that their accountability for when they get it is reduced. So as horrible as these situations are, you have to realize that the government is pretty selective about these stories that they tell us, and that we don't really have a full picture, especially right now, because we used to have the offices of inspectors general at a lot of these law enforcement that would give us reports about the broader scope and use of access to company information about us, and those have largely been underfunded or unfunded entirely in the current administration, both federally and then in some states like Florida as well, I believe.

Yeah, I mean, look, we have a complicated communication system and companies can only promise so much, right? I think that I appreciate that people are upset at ProtonMail because they had an expectation that Proton could protect more than honestly Proton could. And to me, if there's a gap, the gap is between what Proton told people they could do and what they could actually do. And I don't know enough about the company to know how big that gap was or maybe they were overpromoting. I think that's an important thing and people should hold them to account, but, you know, no one can promise you complete protection against law enforcement coming with a warrant, whether that's in the US or Switzerland. There's no country in the world that doesn't have some form of going to a company that has information about you and demanding whatever information they have. That's why it's important to really put pressure on companies to not keep anything more than they absolutely need, not keep it any longer than they need it, and get rid of it after that. Because the best thing a company can say when anybody shows up, law enforcement or otherwise, is "We just don't have that information." That's the best answer for them, and it's a lot easier sometimes than engaging in the fight. So that's what we recognize. I used to joke that EFF was a version of an anti-logging society. Rather than trees, we're talking about data logs, but that's important to know. But it's also important to recognize that we need to push on the policy realms to set the rules in the right place, even as we push on the companies to take full advantage of the rules, if we're going to have basic privacy in the digital age.

Yeah, I think we're in a pretty rough time. You know, the government, since September 11th, has been pretty good at mass collection and less good at actually marshaling that information in ways that are useful. And we're seeing a couple of changes. One is, you know, when we started after 9/11, we were talking largely about the NSA and the national security infrastructures with a little bit of input down to the FBI. Now, we've got the FBI being able to marshal a lot of this information, and we're seeing it slide down to local officials and state officials as well. And then we're also seeing the rise of companies like Palantir who can really use the information in much more powerful ways than frankly, you know, anyone but the NSA was able to use until pretty recently. And, you know, when you couple that with an administration, especially the Trump administration federally, being willing to use this information in so many ways that were pretty much off the table before. Things like, you know, what they call de-siloing, that information gathered for one purpose didn't used to be available to be used for another purpose. So, if you told the truth to the IRS about, you know, information, that information didn't flow over to, say, you know, ICE to be used to deport you or a member of your family. Well, those things are coming down, and the agent of actually turning that information into actionable intelligence that then they can use to, say, do their immigration sweeps is being done by companies like Palantir. So, I think we're living in a really dangerous and scary time because a lot of the things that, you know, we kind of used to warn about in the abstract are actually really coming true right now, and it's a combination of political will and technical capabilities that are making, you know, some of these really bad realities come true for a lot of people.

You know, I used to say that I felt a little bit like Cassandra, right? I was often talking about, you know, kind of scary futures that I could see, but maybe other people couldn't see and weren't living in. And, you know, one of the things that I feel right now is that more and more people are beginning to see the impact of this kind of mass data collection and analysis in their communities, right? There was testimony in Oregon just recently from an ICE agent who said that he had a, you know, a Google Maps-like screen that showed him where a lot of immigrants were, and they used that to target their big sweeps. Now, we know those sweeps are collecting like less than 5% of the people that they're detaining are people who actually have, you know, are either violent or have full deportation orders. So, you know, they're massively over-sweeping up people. And the tool was called Elite, and it's provided by Palantir, that provides this kind of thing. Well, where does that location information come from? Well, we couldn't tell from the testimony, but I think it's pretty clear that it's either coming from sources inside the government that are different than ICE, or it could be coming from the information purchased by data brokers that we know the government is doing. But either way, the impact of this kind of mass surveillance and analysis is becoming increasingly clear to kind of ordinary Americans.

I mean, I think in the short term that's not a bad strategy. Of course, don't download everything again on the burner phone, right? Be selective about what you do. Sometimes I had somebody recently tell me that they'd gotten a second phone, but then they just cloned it, and I was like, well, that doesn't really get you what you think it does. What we have to do is fix this on the law and policy side, right? The courts, excuse me, there is a dispute among the circuit courts on this. But many courts in the United States have said that the border is basically a rights-free zone, that you don't have Fourth Amendment rights as you're crossing the border. And that has really emboldened a lot more of these kinds of things than we had seen before. It's been possible for a long time for them to take your device at the border, but people used to get it back pretty quickly and what they could do with it was a little more limited. But now again, you know, they can clone your device and basically be you as a result of it. So, you know, as a short-term technical matter, think hard about what you're taking across the border because your rights aren't there. As a bigger picture thing, you know, we can fix this, but we have to get members of Congress to say that, you know, your rights as an American don't go away when you cross the border. And they also don't go away when you talk to somebody who's abroad. That is the argument about some of this mass surveillance, is that Americans lose their privacy protections when they're talking to somebody abroad. I think that your rights should be yours no matter where you are and who you talk to. They're your rights. But all of this chipping away at places that are kind of rights-free zones are things that have been done, you know, sometimes by the courts and sometimes by Congress, but we can reverse course and need to.

Yeah, the government...

Yeah, yeah, the immigration authorities call the border this 100-mile zone inside the US, which is, you know, also problematic and ridiculous.

It's the vast majority of the US population.

It's, you know, I think so, yeah. Probably. I don't know. I've seen the maps, but I don't know exactly off the top of my head where they go. Certainly Detroit is right there. Yeah, there's this bridge. There's a bridge, right? Yeah. And certainly Seattle, right? I mean, you know, many, many places that people have been to, and the southern border, there's a lot of people who live, you know, within 100 miles of the southern border as well.

Yeah, the numbers are pretty clear that the percentage of people who they picked up who even have formal deportation orders is pretty low. And when you add, you know, what they claimed, which was the worst of the worst violent offenders, it gets even smaller. I'm not sure how much the funding had to do with it. It's possible, but I think what really happened was they went from leadership that wanted really high-profile sweeps in Kristi Noem and Greg Bovino to some leadership that aren't as interested in high-profile sweeps, but I'm not sure the numbers have gone down at the level that most people kind of assume because the headlines aren't full of these horrible incidents anymore. So it's still going on. I don't think that if you talk to people in the frontline communities, it's not like they're not still seeing people get picked up. It's just that these big grand sweeps that are designed to scare the rest of us are not their strategy anymore.

In terms of Palantir, just to be clear because we've gone back and forth with Palantir a little about this and tried to hold them to account because they have very stated high human rights standards. What they will say is that they only get information that they're authorized to get from the agencies. But it is true that the more information they have, the better they think they can do the analysis. What we know from the testimony in Oregon is that the ICE agents are using these to create heat maps. So they're interested in doing sweeps at places where they have a lot of people that they can pick up at once, which isn't actually the same analysis about trying to go for the worst of the worst, right? They're going for quantity, not quality of their pickups. And that testimony is, you know, under oath in a court case. So I think it's fair to hold them to that.

Well, yeah, I think that they are certainly pushing in every direction and in this particular instance, again, I haven't been following the case that closely, but basically the FBI lied to the judge and didn't tell the judge that this was a reporter, right? They're supposed to be separate standards if they're doing a raid on a reporter and my understanding is that the FBI's approach to this was to essentially not tell the judge that the person was a reporter, but we've seen other incidents where the judge was told that it was a reporter and they still approved the warrant. So, you know, there's a lot of rot in the system, you know, on the government side and on the judicial side that we really do need to address and be clear about. You know, having rights without remedies, right, is not good and Congress keeps passing rights without remedies.

We need to really re-educate both the people in law enforcement and the people sitting on the bench about, you know, our rights and where they are and kind of move away from this what I think is somewhat corrupt idea that, you know, the judges think of themselves as the handmaidens of the cops.

Well, sure, we have a long-standing partnership with Electronic Frontier Austin, of course, one of the OG groups that has been around forever. There are groups all across the country who we partner with, some more formally than others. Right now, we're doing a lot of work around license plate readers, specifically the company called Flock that is license plate readers. We were really one of the first organizations to raise concern about this and now we're supporting groups all across the country who are trying to get Flock out of their communities.

I think it's a shock to a lot of people to realize that their local law enforcement isn't really under local control. Such that, though, like you would think that the mayor could say no and it would matter and all across the country I think people are waking up to the fact that that's not the case in their community and, you know, even though we have mayors and elected officials all across the country who are very uncomfortable with law enforcement having access to these license plate readers or the information off of them. Sometimes they're run by private groups but then law enforcement has access that they really don't have the authority to kick them out of their communities at the level I think most people think.

But we try to, you know, kind of be the brain trust about how Flock works and what's happening and gather information so that we can support a whole lot of communities with essentially connecting them with other groups that are doing the same fights and making sure everybody has accurate information about how these systems work. Our Atlas of Surveillance project keeps track of all the places that have all the various systems and it's one of the ways that we try to provide resources to people. So there's a lot of work going on in that and other things that we call street-level surveillance, right? The mass surveillance is actually out on our streets these days.

Another issue that we're very involved in is age verification. We're seeing age gating and even, you know, trying to kick young people off the internet entirely, trying to support people to push back against that and being involved in the court cases that are arising from the various age verification laws across the country for a couple of reasons. You know, EFF has long believed that age gating is not going to solve the problem that people want it to solve, which is, you know, kind of young people having harms as a result of information they're exposed to on the internet.

But it's going to result in actual harms happening to both young people and others. We know that already, you know, Discord had a data breach, right? Where, you know, tons and tons of people who, you know, presented those — most of the time you got to present a little picture of yourself holding your ID. Like that information with it linking your face to your ID leaked out of Discord, which is a well-used service. So, you know, it makes people insecure. It's just another way to surveil people and add to the stores of information, and I don't think it's going to work.

Absolutely. And that's actually because, you know, for us that's actually a big point because you have very little control over what service the service you actually want to use chooses a supplier you have no control over. You have no relationship with the supplier, but the supplier's lack of care can harm you. Absolutely.