Confronting the Surveillance State: A Conversation with Cindy Cohn

Thank you so much. Thank you for having me.

Oh, well, thank you so much. Yeah, I tried to do that, right? You know, I wanted to both say, 'Look, these are fights we can win,' but also be serious about how long and how hard they are and not sugarcoat that either. So, I tried to get that balance just right.

Yeah, you know, I do think about privacy a little differently than most people. A lot of people think about privacy and they think kind of about the Harry Potter cloak of invisibility that you might put over your head before you're going to do something you don't want your mom to see, or, you know, some other kind of thing that's about secrecy. And I really don't think of privacy that way. I think of privacy as one of the... I mean, privacy can do that. I'm not saying it's not. I just don't think that's why it's really important. Why privacy is important to me is that it gives people with less power a zone of protection against people who have more power over them. And let me give you some examples to kind of explain. You know, we at EFF, we work with domestic violence victims who have their abusers generally putting spyware—not generally, but often putting spyware on their devices to make sure that they can't plan to escape, to make sure that they can't get resources outside of the ones that are controlled by their abuser. They need privacy against, you know, a person in their very home, often to save their lives and the lives of their children. But as you go up, you know, we need privacy against the companies that want to track us all the time in order to make sure that we get a fair price for things and we see the things we want to see. You know, we know that under some of the algorithms that social media uses, if you're a woman and you type in that you're looking for a job, you'll be shunted toward jobs that are traditionally female. You're not going to see the ad to be a CEO. You're going to see the ad to be a teacher or some of the other kind of female-coded school. And the same thing is true for people of color, and then all the way up to our government. You know, we have privacy embedded in various pieces of our Constitution, but we also have it in other places. We have a secret ballot in the United States so that nobody can see who you vote for. Why? Because you need a zone of privacy from the people who have power over you, whether that's the government that's in power or somebody in your household or your boss, so that you get to exercise your franchise and vote for who you want, not who somebody pressures you into. And we create that by having privacy in the voting booth. And then the one that's really animated a lot of my work over the years is I think we need privacy in order to organize to make change. And I know that's one of the goals of this organization, PPJC. And I think about that when you look historically at a lot of efforts to try to organize, to make change in our society, they had to have a zone of privacy around them in order for things to grow, in order for people to feel safe to participate. You know, we're seeing a big lesson about that right now in Minnesota, where the government launched a gigantic, sprawling investigation of people who it thought might be involved in organizing the protests against the ICE sweeps. And what did they do there? They went and got their chats. They got their social media. They got all of these places where we don't really have enough privacy in our lives in order to try to basically prosecute, intimidate, and prevent people from exercising their First Amendment right to protest.

Yeah, it's definitely happening. And you know, we know in the history of activism that the way that movements succeed is they get a significant amount of people willing to stand up and say we need change. You know, the 3.5% of the population is the number that's tossed around a lot. It doesn't really matter what piece, but you got to remember that for all the people who are strong and are standing tall, there's a set of people who might join, who might agree with you, but who need that protection of privacy in order to feel like they can, because they may be at risk for deportation or someone they love might be, or they might be engaged in doing, you know, reproductive justice in a state where that's not legal. They might be doing a lot of other things where their risk profile is just different than others, or even just regular people. So privacy is embedded in our right of association, our right to anonymous speech, and then of course the Fourth Amendment right against search and seizure. And we really need to reinvigorate it, I think, if we're going to stay as a self-governing society.

Yes.

Yeah, I think that sometimes people ask me, are you more worried about the companies or are you more worried about the government? And I, you know, I have to kind of stop them and say, you're not understanding how this works if you think that's a choice that we have, right? The number one purchaser of information from data brokers right now in the United States is the government. And, you know, FBI Director Kash Patel just testified in front of Congress that they're going to keep doing it. So, it's not just the government at large, it's the FBI. It's the part of the government that could put you in jail, right? And they purchase massive amounts of this. Now, you know, in my book, I talk about, you know, the NSA's mass surveillance program. And the NSA doesn't surveil us by coming to us. It surveils us by going to the telecommunications companies and getting records about us from them. So even in the context outside of the data broker context, the companies that have our data are the way that the government gets information about us in its investigations for, you know, many, many years. It's been the method they... that's how they do it. They don't search very many people's houses, but they search a lot of people's phone records and a lot of people's internet records. And that happens in a way that often is really... we're not told about it. We don't get noticed. Even when we do get noticed, we don't have enough ability to stop it, I think, in the law right now. So I just think that we have to think about this holistically, and you have to look at what are the companies collecting, because that's the vector for most of what the government ends up getting. And if we can shrink the amount that the companies can collect and what they can, you know, how they can use it, we can shrink the footprint of the government as well.

Sure. Sure. So, EFF was founded in 1990 by three people who were involved in the early internet. Names that probably are familiar for folks on the peninsula, but Mitch Kapor, who was the founder of Lotus, which was one of the original spreadsheet programs, a guy named John Gilmore, who was an early employee at Sun Microsystems and a cryptographer, and a guy named John Perry Barlow, who was a philosopher and a cowboy and very famously was one of the lyricists for the Grateful Dead. These three guys were active in the early internet on a system called The WELL, that might be familiar to some in your audience, and they noticed... excuse me for a second.

I'm so sorry.

I'm getting over a cold. So these guys were involved in The WELL, and they started noticing... well, actually, Mitch and John Perry Barlow got visits from the FBI asking if they knew about some alleged hacking crimes, and it was really clear to both Mitch and Barlow that the FBI didn't even really know what it was doing. And that they didn't even... you know, Barlow tells the story about how he had to spend the first hour explaining what the crime was to the FBI guy before he could get to the part where he explained why he didn't do it. He says there's an essay called 'Crime and Puzzlement' that might be fun for people to read if you want some history, but they created the EFF. And it's why we're called a foundation, to try to provide lawyers for some of these people who were getting raided by the FBI in these really overbroad and unfocused raids where they would take everything that was connected, you know, every piece of computer equipment. And, you know, they quickly discovered that there weren't a lot of lawyers who knew very much about this new electronic frontier and started hiring in-house lawyers. I got involved in 1994-ish, when I got asked by John Gilmore to take a case that involved trying to make sure that we had the tools of security available to us, privacy and security available to us on this kind of coming internet. So 1994, this is before the World Wide Web, but there were people like John and some other folks called the cypherpunks who were really trying to think about what the world would look like when the rest of us had access to this internet technology that they were having access to. And they realized that we were going to need the tools of privacy and security. They also realized that one of those key tools, called encryption software, was regulated by the government. In fact, it was very tightly regulated. You couldn't publish an encryption program on the internet without getting a license as an arms dealer. And you couldn't get one...

An arms dealer. So this is the U.S. Munitions List. It's this big list of things that you can't export from the United States without a license. So it has things on it like surface-to-air missiles and tanks and chemical weapons, but it also has software with the capability of maintaining secrecy. It had in the '90s, and you know, you can kind of understand this, you know, for those of you who know your history, you know that World War II was one of the big factors was that we broke the Germans' Enigma code and we broke the Japanese red codes. So the military had long thought of encryption as a thing that they needed. But what John and some of the other early internet people realized was that the rest of us were going to need this technology if we were going to have privacy and security. So they asked me to take on the encryption regulations and see if we could get them, you know, thrown out so that the rest of us could have, you know, kind of the basic digital security tool of encryption. So that's kind of EFF's history and how I got involved.

Yeah, you know, after 9/11, there were a couple of ideas that had been floated by, you know, law enforcement and the national security people that had not been rejected, honestly, that suddenly got passed. And there's a couple ones that are really central to how things go. The first one is that the government really embraced the idea of mass surveillance. You know, I mean, since the beginning of the country, you know, if you have a probable cause warrant, you can go into somebody's house. If you have a special warrant under the Wiretap Act, you can wiretap people. And law enforcement really convinced Congress to switch that paradigm from the, you know, first you figure out who you're going to want to listen in on and then you make a showing to a judge and you go and you get that authority to do that, to let's just look at everything everybody's doing and then figure out, you know, collect everything first and then sort out second what we actually need. And so this flipping of things on its head really permeates a bunch of different parts of the law. And they lowered all of the checks and balances around mass collection. And even, you know, the NSA's mass spying, they didn't even put that in the Patriot Act. They just did that off the books until we caught them. And, you know, it was about five years later before we were able to get them to even confirm that they were doing the mass spying and tapping into the internet backbones and going to the tech companies and doing, you know, broad-scale searches in a program called PRISM. So...

Yep. And it was phone records, it was internet metadata, and it was tapping into the internet backbone and going to the big tech companies. So across the board, they really flipped this idea from, you know, first you get suspicion and then you figure out, then you get what you need to get, grab everything first and then sort out second what you need. And this has had profound implications for, you know, our privacy and also for, you know, some of the efforts that people are trying to make to, say, rein in the Trump administration. Now, you know, a lot of the things that happened after 9/11, really, you know, in the cause of trying to protect against terrorism, are now being used by the Trump administration against their political opponents. So, you know, you can trace a lot of what they're doing back to the post-9/11 changes in the law.

I mean, look, metadata is really powerful. You know, there's a very leading national security person who admitted, look, we kill people with metadata, right? Like, the term is a technical term, although the way law enforcement uses it and the way technical people use it, there's a little gap sometimes. But, you know, this is the idea that it's, you know, who you're talking to, how often you're talking to them, where you're talking to them from. And that kind of information is the metadata, whereas the content of your communications is the content. And this distinction between metadata and content is the justification for the government doing a lot of the mass surveillance they're doing and a lot of the surveillance that they're doing that might even be more targeted, but that doesn't require going to a court and getting approval. It doesn't require anything that looks like a warrant. Instead, they get to self-decide. The FBI gets to decide themselves what they get. But this information is really, really revealing. And, you know, if you talk seriously with people in law enforcement and national security, they will tell you that if they have the metadata, they very rarely need the content of the communications. And if you stop and think about it, you can see why. Right? If you're tracking me and you know that I'm going to the chemotherapy center and back four times a week, you got a pretty good guess what's going on with my health, right? If you know where people sleep at night, where they are at night, where they are during the day, you can build a map of their associations pretty well. If you know how often people talk, you can guess the level of relationship that they may have. So you really don't need the content of communications in order to know a real lot about them. And in my book, I talk about a study that a Stanford student did, a guy named Jonathan Mayer, who's now at Princeton, kind of just taking like a month's worth of telephone records from a bunch of people voluntarily and figuring out what they could find out about them. And it was a lot. It will raise your eyebrows how much you can tell just with metadata. So this distinction that they're trying to rely on is based on them basically saying, you know, essentially, well, don't worry, you know, we can't tell very much about you by your metadata. That's what they mean by, well, we're not listening into your calls, we're just doing metadata. They're trying to get you to think that metadata isn't very privacy-invasive, and it's just not true.

Yeah.

Yeah. Well, you know, one of the things that the Patriot Act did was it broadened the use of these things called national security letters, which is a kind of subpoena, which means you don't go to a court. The FBI issues it on their own, and they issue it to our service providers and ask for our metadata, metadata about us. And I heard from a little phone company called Credo Mobile that they had received one of these national security letters a few years, kind of the late... my gosh, I'll get the timing wrong if I guess. And they wanted to know what they could do about it. And, you know, from the very beginning, National Security Letters, the way the Patriot Act changed the NSL, like we call them NSL statute, made it really unclear whether you could even tell your lawyer that you got one. And, you know, so these subpoenas are issued to a company. The company is forever gagged from ever telling anyone that they got asked for information about their customer. They turn the information over. And it wasn't even clear that they could tell their lawyers what happened. There had been a couple of very courageous organizations, some libraries and a small ISP on the East Coast, that had stood up against them. But the cases were still lingering when I heard from Credo Mobile that they wanted to see if they could stand up against their national security letter. So, we brought...

Yeah, they still do. They're not as active as they used to be, but they still exist and they still give money to activist groups. EFF has been one of them. Even before this happened, EFF had been one of the recipients. And they do a lot of good work and support progressive causes. And so, of course, they wanted to stand up when they got a national security letter. They were uncomfortable with the Patriot Act, and they were very uncomfortable with the idea that they were going to be gagged forever and that the FBI could just come and demand information about their customers and make them never tell anyone. So we took this case on. We called it Case X... no, we called it Case Q, the first one. And we had to do it all under seal. It was six years before we could reveal who our client was. We even had a Wall Street Journal investigative reporter try to figure out who they were by reverse engineering a bunch of the pleadings and stuff. But we had to litigate this in secret for a very long time. Now, ultimately, we got a very good first decision from our judge here in Northern California. And on the basis of that decision, the law was actually amended by Congress to fix about, you know, I would say, 40% of what we were upset about. And we went back to the court again, and ultimately we were not able to get the rest of what we needed, but we were able to get the forever gag shrunk to a three-year gag, with the FBI having to make a new showing if they wanted to extend the gag. We were able to get it so that companies could reveal how many of these NSLs they get in little bands, so that the public can get an idea of how often this was being used. This was a little tool that the FBI used occasionally before 9/11. And after 9/11, there were hundreds of thousands of these issued.

Yeah.

Correct.