Ep480 Cindy Cohn Privacys Defender

Hi, I'm Cindy Cohn, the executive director of the Electronic Frontier Foundation, and you're listening to Firewalls Don't Stop Dragons.

Oh, thank you. I'm very excited to be here.

Yeah, I think it's a really good thought experiment, right? Because I think sometimes we're bogged down in all the ways the internet isn't private and isn't secure right now. And so it could be hard to see what it might have looked like if we hadn't at least got the foundational freeing of encryption done. And I think there's a few things. I actually think there's a chance that the internet would have kind of remained the plaything of hobbyists, right? Rather than actually the kind of thing that's embedded in our everyday lives. Certainly, it wasn't possible to really have commerce online, to buy things online or, you know, donate to charities or do any of the things that now we kind of routinely do online, banking online, any of that wouldn't have been possible if we hadn't freed up encryption. But even aside from that, you know, people build businesses, they work with people across great distances to kind of develop ideas, think things through. They need privacy and security to do that. You know, legally, we think about it in the context of things like trade secrets and confidential information. But basically, people need the right to have a private conversation in order to do many things. I mean, some of them personal, some of them professional. And I think if it was always the case that whatever you did online could be instantly available to any malicious person who wanted it and routinely swept up by third parties who were trying to target us, I mean, that already happens. It would be much worse if we didn't have the possibility of encryption. I think about the encryption that people see and then the encryption that people kind of is under the hood of the internet. You know, the encryption that people see, they're choosing to use Signal or WhatsApp or, you know, Apple end-to-end messages or Verizon. I really still want them to talk to each other, but at least if you're inside their little walled gardens, you can have strong encryption. The fact that when you turn off your phone, it automatically encrypts so that if somebody gets a hold of your phone, they don't get your whole life. That's encryption happening. And then when you type in to go to your bank, HTTPS, you know, mybank.com, you can feel pretty confident that you're actually going to your bank and not to some place, some third party that's hijacked your traffic. That's because of some of the encryption that's happening kind of under the hood of your browser that EFF and a bunch of other folks have helped deploy through an organization called Let's Encrypt that helps make sure that you get the S in HTTPS as the default, not a kind of, you know, nice-to-have add-on sometimes, which is kind of what it was when we started that project. So all throughout what we do online, there is encryption helping us along the way. We need more of it, but I think the alternate future would be much, much worse for people. And again, I think the end result might have been that, you know, people just wouldn't use the internet for anything serious anymore. And that would have left us kind of unable to do the kinds of things like you and I are doing now, right? Recording a podcast. We're not in the same location or, you know, staying in touch with loved ones over a great distance in a serious way. And those kinds of things, you know, it's not just the commercial, it's the non-commercial stuff that we kind of take for granted right now.

Yeah, it's a very nice graph. You can see Let's Encrypt getting deployed and the number of websites that offered HTTPS as their default just went way up. And it was pretty simple. It wasn't all that technical, as you said. We took a thing that was available and we made it free and easy to use. And those two things made a huge difference in what was kind of a luxury, you know, security world to a default security world.

I mean, I think that the power of encryption and the need for encryption will ultimately win. You know, even in the '90s, the government was claiming, oh, let's just use a backdoor that only good guys can use and that bad guys can't use, right? There was a thing called the Clipper Chip that they wanted everybody to use. And my friend Matt Blaze, who I was just actually on a panel with yesterday, you know, kind of demonstrated how easy it was to break the Clipper Chip and kind of ended that little story that they were telling about, you know. I think that law enforcement's interest in making their job as easy as possible never goes away. They always want every possible tool. The entire Constitution, I would argue, was written as a set of actually you can't go this far because there are people's rights at stake in the First Amendment and the Fourth Amendment and a lot of the laws we have. And I think that law enforcement, especially after 9/11, has really gotten used to the idea that they get whatever they want as long as they can demonstrate that somewhere, somehow it might make it easier for them to solve a crime. And I think as a society, we've kind of lost the ability to evaluate the costs and benefits of these requests. And again, it's not just in the US. You're right. We're seeing it overseas as well. It's actually even worse in the UK and Australia right now. And I think it's because they're, again, law enforcement never goes away. They always live to fight another day. They always come back. Their wish list doesn't really change. Their story about why they need their wish list changes depending on what the public's attention is about. Right now it's a lot about children and harms to children, but, you know, it was terrorism for a while. It's, you know, sometimes it's porn, child porn. It really, the problem moves, the answer doesn't, that the government demands. And I, you know, I just think that there's always going to be a push and pull between what law enforcement wants and what we as a society should give them. I think that we won a pretty big victory with all of us being able to deploy encryption, but I don't think this push and pull will ever entirely go away. At least not until we really have a set of pretty firm nos out of society that, like, we really, we really, like, you know, we recognize that you can't build a backdoor into the security of systems that only the good guys can use.

And I like to use this analogy. I mean, your audience is a little more technical than others, but when I'm talking especially to a non-technical audience, I say like, imagine that, you know, there were some break-ins in your neighborhood and the cops came to your front door and they said, hey, we really need to catch whoever's breaking into this. So, would you leave your back door open so that in case you're a bad guy, we can get in more quickly and discover, you know, that you're the burglar? And you would say, get a different way to learn how to do your job better. Like, you're going to make me unsafe, not only from you and excesses that you might have, but from the actual bad guys out there. This is a really dumb way to think about solving crime by making everybody less safe. But that's effectively what every single version, and they've done so many versions of, you know, backdoor, side door, client-side scanning, blah, blah, blah. It doesn't matter which way they come up with it. That's essentially the deal that they're trying to get us to buy into. And I just think that the answer has to be, you know, this is not the only tool in your toolbox. We live in a time when law enforcement has unprecedented power. This is a bridge too far.

I think that that's right. And, you know, I think the other thing is that, you know, I think you're exactly right that after 9/11, there was this never again idea. But there was another thing that happened after 9/11, I think, that was really, it's pretty audacious actually from my perspective, which is, you know, law enforcement said that the problem was our rights, right? That the problem was that we had too much privacy. Well, the 9/11 Commission actually looked into this theory, right? They did not find that the problem was law enforcement wasn't able to do the investigations that it needed to do to uncover this horrible, horrific plot because of our rights, because of privacy rights or the distinction between national security and domestic surveillance or any of the other things that, like, they immediately came out and said this is why we need the Patriot Act is because our, you know, our privacy is getting in the way of law enforcement. Well, we actually had a blue-ribbon panel take a look at it. The problem wasn't our rights. The problem was those people paid no attention to the signals that did not meet with their previous ideas, right? This groupthink idea that they get a story in their head. I mean, Bush was told Bin Laden is, you know, aiming to strike inside the US and he just couldn't take it in because it didn't fit his mental model. And so, you know, to me, the audacity of the law enforcement and national security establishment blaming us for their own failures is, it's really kind of sad, but also scary, right? Like, our rights weren't the problem, but yet they sold the American Congress and, you know, both above the board and secretly that the problem were our rights and that they needed to be able to surveil everybody better in the future in order to stop a terrorist attack when they had plenty of information if they'd just taken it in beforehand.

I mean, the fights are still ongoing. And the second one you mentioned is really the one that I've spent a lot of time focusing on, which is this metadata/content distinction, which again, you know, we inherited that in the digital world from the non-digital world, the envelopes and stuff. I don't know that it made any sense in the non-digital world. I actually think that, you know, but regardless of that, it makes no sense in the digital world. You know, I've got a quote in my book from Michael Hayden, the NSA director, saying, you know, we kill people with metadata. And Stewart Baker, who is the NSA's general counsel, who is kind of somebody who I never agree with, they admit, and I don't think they admit, I mean, they're just saying the truth, which is metadata is tremendously powerful. If what you're interested in is making sure people can be secure in their homes, papers, and effects, which is, of course, I'm using the language from the Fourth Amendment, the idea that metadata wouldn't be included is crazy. It's crazy. The other piece of this kind of ugliness is third-party doctrine. This idea that when you store your data with a third party, it falls out of Fourth Amendment protection as well. Another one that has, you know, just the shift to how we live now has meant that these two distinctions that are both kind of offline distinctions online make no sense. Make no sense. And so we're continuing, you know, we've been chipping away at both of these. You know, we got a decision from the Supreme Court a little while ago called Carpenter that chipped away a little at this idea with regard to location data over time. And we're going to continue to, there's a case up in front of the Supreme Court right now called Chatrie that's going to be argued pretty quickly that's about kind of these geofence warrants, these broad warrants that ask for the names of everybody who's in a particular location. The facts of that case are not great. That's not the case I would have wanted to take it on the facts, but, you know, we can't control these things sometimes. So, I'm hopeful, but bad facts make bad law. We may have to come back again on that one. But we're hopeful and we're trying. EFF filed a brief and we've been supportive of this case for a long time. So you're right that the switch to the digital era took some, I think in both of these cases, non-digital distinctions and made them make even less sense in the digital age, and we're still fighting all of those. Although again, we win some things, and we've won some things on the, you know, straight up first thing you mentioned, which is, you know, search and seizure warrants. The very first case that EFF did was the Steve Jackson Games case, which involved the scope of what you can get with a warrant in terms of seizing every device in a household or something like that. And the court required some sensible limitations. We still see bad warrants out there and we still have to fight them. But the actual law isn't as bad as it is in some of the other cases, and we continue to try to push back. But, you know, this is why EFF was created. You know, the founders of EFF really were, you know, very forward-looking in thinking about, you know, what were the parts of our rights that were going to need special defense in the digital world because things were going to change. And, you know, sometimes people think that the people in the '90s who were on the internet were kind of wide-eyed optimists who thought everything was going to be magically better. And I always point out, like, you don't start an organization like EFF and hire a fighty lawyer like me if you think it's all magically going to turn out. We knew it was going to have to be a fight. We thought it was worth fighting for and that, you know, if we could set things right in the digital age, we could create something better than a, you know, not just parity with the offline world, but maybe something better. I think that was all the hope. I'm not sure that's how it's turned out, but that's still the goal.

Yeah, I think they're not sufficient either. They are better than what happened before. We got to remember all the times, you know, FISA came about because of the Nixon-era spying on people, both the, you know, kind of narrow, you know, kind of the Watergate-specific things, but the broader things that the Church Commission brought out and bringing some of this under congressional control at all was a very big lift. And creating the secret FISA court, which again I've never liked, was better than what happened before, which is they basically said, well, if we say national security, it's a constitutional-rights-free zone entirely and there's no oversight. It's the president's ability to do this all on their own. The other two branches have nothing to say about it. So, it's insufficient, and I think its insufficiencies have been more obvious over time, but it's better than what happened before, and it's what I don't want to go back to. So I think that we need to do more. And, you know, I will tell you that, you know, the biggest piece of unfinished business for me is these national security holes that we poked into our rights in various places. The state secrets privilege you mentioned, the classification stuff, the limitations of FISA, these are all things that we still have to do if we want to regain the kind of, you know, the ability to be self-governing. I think you said that exactly right. I mean, you know, I'm not that much of an originalist, but it is interesting to me that the Fourth Amendment to the Constitution was put in during the time of a national security crisis. For God's sakes, we had just, we were, we had just won a war for our independence. If that's not a national security crisis, I don't know what is. And, you know, they decided that they wanted these limitations, and they did not put a national security exception into the Constitution. Many constitutions around the world allow, you know, in an emergency situation, a national security situation, for the Constitution to be suspended, and that was available to the founders of the United States, and they did not put it in. And I think that I really fear that over time, we've actually built one ourselves in a way that the framers would never have done at the time. And again, I'm not much of an originalist, but a majority of the people on the Supreme Court say that they are. And so I think that these are important things to raise for people who are interested in the history, you know, a historical way to think about the Constitution.

I mean, there's a couple of places. The place that we ran up against in our challenge against the NSA spying is called the state secrets privilege. This was a judge-created privilege that allows the government to withdraw information from a court case if it would harm national security if the information was heard by the courts. And the Supreme Court, after, you know, there's lots of pieces of the FISA law that I think make this interpretation wrong, and that was what we argued in the case, but ultimately the Supreme Court said that the state secrets privilege wins. And then once you, you know, once you have to remove enough evidence from a case, the whole case, you can't win your case. And ultimately what they said was we couldn't prove standing. We couldn't prove that our clients were impacted by the mass spying that the government admitted impacted, you know, tens if not hundreds of millions of Americans involving the nation's leading telecommunications carriers. They said all of that, but we can't identify which telecommunications carriers without violating the state secrets privilege. Friends, let me tell you, we have two in the country, right? So, it's not like it was a hard thing, right, for people to guess which major telecommunications companies were engaged in the mass spying if you were talking about hundreds of millions of Americans. But telling everybody that AT&T was one of the two companies would have just violated the state secrets privilege. We couldn't prove that, and any evidence had to be thrown out. And so, therefore, we didn't have standing, and the case was dismissed. You can tell by the way I tell this that I just think this was a horrific and cowardly move by the courts to refuse to decide, you know, on this argument whether it's okay to spy on the entire country as a side effect of going after the people that you're interested in spying on.

And there's a specific one in FISA, and it's called, you know, for the geeks out there, it's called Section 1806F of the FISA law that specifically says that if a court is going to consider whether surveillance is legal or not, it can do so. You know, the lawyers call it ex parte in camera, meaning there's a secret, you know, it's secretly given to the judge. The judge looks at it. The other side doesn't get to see it, but the judge can evaluate, you know, whether it was done or not. And what we were arguing all along is we don't actually think we need any secret information because the Wiretap Act is violated at the minute that the government gets information about us. That the minute they divert our communications traffic into their control, regardless of what they do with it afterwards, that's where the violation occurs under the Wiretap Act, the FISA Wiretap Act. But if we needed any stuff after that point, the 1806F would be the way for the court to evaluate it. And there might have been some arguments under the Fourth Amendment that they needed to see that, but I don't think under the statute. And so that's what we argued the whole time. And the Supreme Court just said, no, the state secrets privilege is like this giant, you know, hand that just slaps down everything regardless of what Congress specifically created a process that ought to apply here. What they said was Congress didn't create the process specifically enough. It's like, I just think it's a dodge. I don't think it's real. I mean, you know, maybe the answer is to bat it back to Congress and Congress to say, well, we really meant it when we passed 1806F, and maybe that would work. But, you know, I just think that it's clear from that analysis that what they really were saying is we're going to believe that the executive gets to do what they want as long as they say national security, and we're not going to step in and let the judiciary play its role of deciding whether the president has overstepped his authority or not.

Oh, I can go forever on this. You could tell I'm still pissed off.

Yeah, you know, this is something, and again, this isn't my idea, but I tried to kind of articulate like why I think privacy is one of the fundamental things that we need to protect to have a self-governing society because I think of privacy as a check on power. And I kind of like to talk about this in kind of circles. So, you know, starting with the smallest circle, you know, my colleague Eva Galperin works with domestic violence victims who are struggling with abusers who put spyware on their devices so that they know who they talk to, know where they go, know what they do, the spyware. And why do they do that? Well, they have more power over their victims. And they know that by spying on them, they will be able to limit what their victims can do to get away. You know, these people need privacy in order to literally often save their own lives and their children's lives and get away from a more powerful person who is literally living in their houses. So that's kind of, you know, from the house size to the corporate size. We're beginning to see that companies knowing so much about us and what we do, which was sold to us as, you know, we're going to get better ads, is being used against us in some pretty dramatic ways, like price discrimination, how much we pay for things. It's increasingly personalized based upon them trying to maximize how much we'll pay for something based on how desperate they think we are for the thing because they know all this other stuff about us. This is a situation in which the companies have more power than us because they know more about us than we know about them, and they're doing pricing accordingly. I just saw a news story a couple weeks ago that employers are using the massive amount of information about potential employees to decide how much to pay them based upon how desperate they are for a job, right? So, you're going to get paid less because they have more power than you because they know more about you than you know about them, and your negotiating power is going to go away. And then the place where I've spent most of my career is vis-à-vis the government, where, you know, let's start with where privacy is kind of already baked into our system, which is the secret ballot, right? The fact that we get to vote for who we want to and the privacy of a voting booth and nobody can stand over our shoulder and make sure we vote for who they want us to is privacy built into the very basics of our enfranchisement, our right to vote. Why? Because there's pressure in other places that the boss will tell you who you better vote for or you'll lose your job, or again, in your home, the pressure that sometimes husbands would place on wives to vote for who the husbands wanted them to. A fundamental part of us gaining power as voters in a democracy is the secret ballot. But I think it's actually bigger than that because if you want to organize in order to convince your neighbors and your friends and your colleagues to vote for somebody other than the person in power, you need a zone of privacy in order to do that activism. That's why the first thing the autocrats do when they get into power is reduce the amount of privacy that their citizens can have so that they can stop any effort to try to build momentum against them by having more power over their constituencies. And every social movement in my lifetime that had a public part had a private part before that. Right? The gay rights is one that came about during my lifetime where if you, in the, you know, when I was a kid, if you talked about how gay people ought to have equal rights, you could actually get yourself beat up, you could get those people killed if you identified who they were. And that happened in society. And we then had, you know, a big public push for gay rights. It ended in the Supreme Court with some really good decisions. Hopefully, they're not going to be rolled back. But the private parts of that organizing had to happen before the public parts could. And I think that's tremendously important to recognize because if we want to be able to organize to change our government and to change our laws, we need this privacy because it's one of the ways that those of us with less power can get some protection against those with more power. And, you know, we're seeing it today, right? There's a lot of activity where people are very uncomfortable with ICE raids in their neighborhoods. People are very uncomfortable with a lot of things that this administration is doing. And what is the administration doing is trying to claim more power to know more about more of us. And what are people doing? They're using privacy. They're using encrypted tools and private conversations and things that are hopefully, you know, sheltered from governmental surveillance as the places where they're organizing to make change. So, it's happening all around us. We just kind of don't call it that. We've kind of, I think, we put privacy in this little kind of side thing where it's a, you know, it's something that you just check off on your way to get a tool or something that you use when you're doing something that's, you know, society-icky or not liked by the majority of people, as if it's kind of this side thing when, you know, my point, one of the things I'm trying to make in the book is that it's actually central to self-government. It's central to having control over your life.

No. And I think Dobbs is really one of the moments, you know, the repeal of Roe v. Wade kind of took a whole set of society who thought, well, I have nothing to fear, so I have nothing to hide, and suddenly made them realize that maybe they did and that maybe this targeting that they thought was only going to be for, you know, terrorists or...

others or, you know, Muslims kind of traditionally after 9/11 suddenly reached a whole other set of people, and the aperture, you're right, the aperture of who got targeted moved pretty dramatically and expanded pretty dramatically in terms of sheer numbers of people. And I just think that we're living in a time when that keeps happening. And so even if you think you're somebody who has nothing to hide or nothing to fear today, I don't think you could feel safe that that aperture isn't going to move and affect, if not you, people who you love, people in your community. You know, privacy is a team sport. Like, who's in your contacts? Because it's not just you. You think you're making an individual decision based upon your own risk, but you're actually making a decision about the risk to all the people who you care about and who could be tracked through you.