When you need to build up your team to handle the growing chaos at work, use Indeed sponsored jobs. It gives your job post the boost it needs to be seen and helps reach people with the right skills, certifications, and more. Spend less time searching and more time actually interviewing candidates who check all your boxes. Listeners of this show will get a $75 sponsored job credit at indeed.com/podcast. That's indeed.com/podcast. Terms and conditions apply. Need a hiring hero? This is a job for Indeed sponsored jobs.
Welcome to the Monopoly Report. The Monopoly Report is dedicated to analyzing the big issues impacting the global advertising economy. I'm Alan Chapelle, outside counsel and fractional chief privacy officer to a bunch of tech companies, and am the principal analyst at the Chapelle Regulatory Insider, which is a monthly report that focuses on privacy, antitrust, and other regulations impacting digital media worldwide. You can find a link to the sample copy of the Chapelle Regulatory Insider in the show notes. Let me start with a question that might sound simple, but really isn't. Who decides what you are allowed to keep private? Not in theory, but in practice. When you send a text, search for a doctor, or let your phone tell you the fastest way home, somebody, somewhere, is making a decision about who else gets to see that communication.
And for the last 30 years, the people fighting to make sure that decision lands in your favor includes my guest today, Cindy Cohn. Cindy is an American civil liberties attorney specializing in internet law. She served as an executive director for the Electronic Frontier Foundation from 2015 to 2026. Cindy has just released a wonderful book that I highly recommend. It is both a professional memoir and a manifesto titled Privacy's Defender: My 30-Year Fight Against Digital Surveillance. Cindy's book details her decades-long career defending digital privacy, human rights, and free expression online. I'll place a link to Cindy's book in the show notes and encourage you all to buy it.
Cindy was there at the EFF for over 26 years. Before that, she was what she charmingly calls a baby lawyer at a small firm taking on a pro bono case that most people thought was unwinnable. That was the Bernstein case. The US government had classified encryption software as a weapon. Cindy argued that code is speech, that it deserved First Amendment protections, and that all of us were going to need the ability to keep secrets as we moved into the digital age. Cindy and her team won. And if you ever bought anything online, banked from your couch, or sent a message you'd rather not broadcast to the world, you have benefited from that win. So, we're going to talk about Cindy's illustrious career, but we'll also touch on other topics such as how timid courts have become in a post-9/11 world, why a single all-powerful privacy regulator might be a terrible idea, and the private right of action as an enforcement mechanism. Behavioral advertising, surveillance pricing, and whether publishers could actually keep the lights on with contextual ads alone.
And because this is the Monopolies Report, we'll spend a bit of time talking about the connection between privacy law and competition law. As I noted above, Cindy's new book is called Privacy's Defender. It's a great read if you love privacy and want to know a bit more about the history of privacy in the US. It's also helpful if you want to understand a bit more about how we went from John Perry Barlow's libertarian mantra of keep government off my internet to the more toxic form of libertarianism we have today. So, let's get to it. Here's Cindy Cohn. Hi Cindy, thanks for coming on the pod. How are you?
Oh, I'm well. Thank you so much for having me.
Where's my audience finding you today?
I'm in San Francisco. I live in the Mission District. I'm quite literally in my closet because it's the quietest place and where I record podcasts from.
Oh, fantastic. Yeah, it's kind of nice to get that little confined space to record. I've been known to record vocal tracks and if you kind of sing into the closet, that way in New York City your neighbors don't scream at you because it sort of muffles it at least a little bit.
Well, this is a creaky old Victorian, beautiful old house, but finding a place that is not loud is very difficult.
Understood. Yeah, same with New York City. So, with your permission, I'd like to start with some of the cases described in the book and maybe dig into your mindset at the time. So, you took on the Bernstein case out of a small firm. It was pro bono as what you would characterize as a baby lawyer. I love that term. What did you understand about the stakes of freeing encryption that perhaps others at the time did not?
Well, I mean, I wouldn't say I was entirely prescient, but it seemed very clear that, you know, government saying software with the capability of maintaining secrecy is a weapon was wrong and that we were all going to need software with the capability of maintaining secrecy as we were moving into the digital age. I think, you know, I was an international human rights lawyer, you know, that's kind of the frame I brought. So, I was thinking a lot about the needs of people who want to organize for social change or political change to be able to do that in a private way without the government that they're opposing listening in.
And so, that was the frame in which I thought this was going to be really important. You know, it turns out that encryption is really important for security as well and, you know, kind of protecting us against not just, you know, government but actual, you know, kind of criminals and bad guys and things like that. And I don't think that was front of mind for me because I was really focused on the privacy side of encryption and not the security side at the time. But, you know, I would argue that looking back, you know, I don't know. They're not really in conflict, but the security side ended up being pretty darn important, too.
Oh, absolutely. I think you can argue that there may not have been an Amazon but for your work here.
I think that that's right. I think commerce online, certainly the voices that were pushing hard to try to get these encryption regulations lifted were folks that were interested in commerce online. But also just business online, you know, secrets, business secrets and things like that. So, the business interests were aligned with kind of, you know, me and the crazy hackers and human rights people who wanted to do that and I think it made us have a particularly big voice in the fight.
I think this was covered in the book, but I'm curious. Did you study human rights law?
Yeah, in law school. I did and then I did a fellowship at the UN Center for Human Rights in Geneva right out of law school. That was, you know, that was what I was interested in doing and I had studied it, you know, in undergrad as well. I got to sit in on a law school course when I was in undergrad about human rights because I was early on kind of fascinated. And I remember this was the time, I'm an old lady. This was the time when we were talking about apartheid in South Africa. Later we were talking about Central America and a lot of the issues around there.
Well, I remember, so one of the reasons I got into privacy is I went into law school and I wasn't really sure what I wanted to do with it and I thought two things jumped out at me. Human rights law and European Union law. And it turns out that, and look, I wasn't prescient at all here. I was just sort of doing what I thought might be interesting. But it turned out that if you wanted to go into the privacy world, human rights was certainly not a bad way to go.
No, I think it is. I think it's a good framing. I still love the, you know, the international human rights framing of surveillance for instance as looking at whether it's necessary and proportionate, which is how it addresses it, is such a really powerful way to begin to look at all kinds of surveillance. But I really like the framing in the international law stuff. It's a lot easier than trying to kind of deal with the, you know, 1700s thinking about, you know, the Fourth Amendment and being secure in your papers and things like that. I think necessary and proportionate ends up being concepts that are a little more robust to technological change.
So, I was recently watching a documentary on Steve Martin. And a huge fan, he's such a talent and hugely accomplished as an actor and a writer. But there was a period of time in the 1970s, and I can kind of remember this from TV. I mean, he was an absolute, flat-out megastar. Stadium tours, you know, huge media saturation. And I was struck in the documentary by the way that that success had sort of influenced how we perceived the rest of his career. And so bringing this around to you, you almost started off your career with this huge win, the Bernstein case. And how did that big win impact your thinking and approach going forward?
Yeah, I think you're exactly right. And I mean, I'm nowhere near like Steve Martin, but I think, you know, I've often joked that it's a little like when you first walk into the casino, right? And you win the very first time and it keeps you coming back. I think that is part of the reason why I continue to really enjoy and feel energized by the litigation process in part because we were kind of nobodies and we showed up and we were right and we won. And so I kind of think of the courts as a place where it's not guaranteed, but it's possible that if you don't have any connections, you don't know anybody, you're not important, you can still present your case, the judge can look at it, and you can win. So, I felt like certainly compared to the other two branches of government, the judiciary offered the opportunity for that.
And I think that one of the things that then has been frustrating since 9/11 was the increasing timidity of the courts to really apply the same amount of analysis to national security claims by the government as they do to any other kinds of claims by the government. And, you know, in the Bernstein case, we were up against national security claims, but we had a judge and judges who were willing to, again, not willing to suspend their judicial analysis because the government came in and waved a national security flag. And that really changed after 9/11. And I think having done the Bernstein case, I was a little... Well, first of all, I was really angry about it and frustrated about it, but also willing to continue to push because I know there's a better version of the judiciary out there. I experienced it. And I feel like if we just keep pushing, we can begin to, you know, shift the judiciary back into a place where they're just willing to give the same analysis in a national security case in terms of evaluating the government's arguments as they do in other cases. That's a very legal geekery answer. Sorry.
Well, no, no, it is. I don't see that at all. And you actually went in the exact direction I was hoping you'd go. It isn't just national security. There's a component here that just philosophically the courts are very different than they were in the, you know, in the early to mid-80s. And I'm just curious if you have the same level of optimism regarding the courts. I mean, are they at this point just the least bad option?
Yeah, I mean, it's hard to... I do think that it's much worse, certainly at the Supreme Court level. It's very problematic and in some ways I wouldn't even call them the least bad option at this point. They're kind of driving things in a very bad direction in terms of empowering the executive. I mean, you know, again, there's lots of specific things that I don't like in the specific decision-making of the court, but the overall thing that I think underlies a lot of this is they're really letting the executive branch become the most, you know, become the one branch that rules them all, right? They're supporting an imperial presidency that I think is very dangerous in all sorts of things that I care about substantively. So, I really worry.
Now, I, you know, I don't want to throw the whole branch under the bus because there are plenty of very courageous judges right now, especially when we're looking at some of the ICE cases and some of the Trump administration cases. We are seeing courts having to be not just courageous in the face of national security claims, but courageous in the face of very direct attacks, personal attacks against them. And I really want to make sure that we're not counting them all with one broad brush because that's not the case. But overall, I do think that there's been a shift and that it's very dangerous and we have to find a way to really address that shift if we're going to get back to a place where the courts can be a place where people without power can win.
And, you know, I don't want to say that the '80s were a perfect time. I think there's plenty of really good analysis that show that overall and in many, many cases the courts are really a reinforcer of power, not standing up to power. But, you know, I kind of grew up and cut my teeth on some of the counterexamples and I'd like to see them strengthened.
And maybe that's just the trick is finding the zones where one can be optimistic. I want to return to the book a little bit because... So, you won Bernstein and the government had backed down, and thank you because we're all enjoying the fruits of that. But then the Snowden affair had demonstrated that the NSA had really gone through the back door hollowing out at least part of the victory. So, walk us through what happened when the EFF sued AT&T and then eventually the government and what led to Snowden demonstrating that the government was in fact lying.
Yeah, so, you know, we started hearing rumors after September 11th that there was some kind of massive spying thing happening. And people would kind of say, you know, we can't tell you about it, but it's huge. Or, you know, EFF would be very upset if they knew. But we were trying to pull together enough evidence to actually have a lawsuit that could survive kind of the initial step where you have to have some evidence when you show up in court. And we knew that this was a national security case, so we needed to have probably more evidence than you would need to have in a regular case. I'm not sure that's great, but it's certainly the situation. So, we were digging around, we were thinking about legal theories, and then in late 2005, The New York Times ran a story about the Bush administration spying domestically in the United States. And about three weeks after that, we were in our offices on Shotwell Street here in the Mission in San Francisco, and literally a guy in a trench coat knocked on our front door.
And he said, 'Do you people care about privacy?' He had kind of a raspy voice, and I can't do the Long Island accent, but my boss, Sherry Steele, let him in and said, 'Yes, we do.' And he showed up. His name was Mark Klein. He had a bunch of paper and pictures of the mass spying apparatus that had been installed at the AT&T facility in downtown San Francisco in a room called Room 641A where a copy of everybody's communications that travel over the fiber optic cables that carry our communications... and this is right at the juncture, one of the junctures where communications that are domestic leave the AT&T domestic thing and go out to the broader internet including internationally. These are called peering links and they had installed an ability to make a copy of all the traffic going through these peering links and one copy went off to the internet and the other copy went into a room that you couldn't get into unless you had NSA clearance.
Mark had helped hook up this set of connections at the peering links and he kind of thought something was weird about it. Then he retired from AT&T. He kept copies of this stuff and he showed up at our front door with it and this was the evidence we needed to launch litigation about these stories that we had been hearing. And we actually sued over that program which ultimately we learned was called the Upstream program and two other programs that we had evidence about: the massive telephone records collection and the massive internet metadata collection. So we sued all three of these things. We sued AT&T first because AT&T as a telephone company had a legal duty to do nothing with your communications other than deliver them to where they go and protect their own networks, and handing everything over to a room controlled by the NSA isn't either one of those things.
So we sued the company directly because the government has a lot of immunities and hoops you have to go through before you could sue them and we thought the case against AT&T was cleaner. This was the brainchild of my colleague at the time, Kevin Bankston. So we brought the lawsuit. It was called Hepting versus AT&T and we were chugging along and doing okay. We won in the first motion and we went up to the Ninth Circuit and the argument went quite well. Then, we learned that AT&T and the government were going to Congress to try to get AT&T out of this lawsuit. There were many lawsuits at this point in time. Once we sued, there was a whole bunch more. And they went to Congress and they got retroactive immunity for this violation of our rights. That's not a thing that existed before, but they got it passed and that killed our first case against the phone companies. They got retroactive immunity for what they'd done to violate our privacy for many years.
So, we launched a second case against the government, against the NSA. That case is called Jewel versus NSA. So, this is, you know, going on for quite a while. We're still struggling. The government is still neither confirming nor denying that they're doing it and basically insinuating that we're making it all up. So, this is 2006, 2007, 2008. Then, in 2013, Mr. Snowden shows up on the scene and presents so much information about the mass spying that we'd been suing over for all these years that the government and the Obama administration could no longer really confirm or deny it and they actually confirmed that it was happening.
So, Mr. Snowden did a huge favor to, you know, me and my lawsuit, but the American people by forcing the government to stop playing games about the mass spying it was doing that implicated many millions of people's communications that went into this secret room and making it so the government could no longer deny it. And the first question I got from him through his lawyer, Ben Wizner at the ACLU, was, 'So, do you guys have standing now?' indicating that the government's refusal to affirm or deny had meant that we were really kind of stuck in the starting blocks in our cases. And he was trying to make sure that they couldn't deny it anymore.
You know, that's how kind of Mr. Snowden came in much later and presented so much evidence about the spying that the government could no longer play the games it had been playing about it. Which is one of the reasons why when people are like, well, Snowden could have just done a little, he didn't have to do a lot. And maybe he didn't need to release as much information as he released. Well, I understand that from people who aren't deep in the fight, it misunderstands some of the problem that he was trying to address, which is the government playing a lot of games with the little bits of information we got and presenting so much information that they really had to change their posture.
But also, this isn't a situation where you want to just release a little bit because if you didn't release enough, boy, it would sure be a shame to risk everything that Mr. Snowden has risked to not be successful. I mean, heck, I would err on the side of caution and make sure you guys had as much information as you needed.
Well, and you know, and we weren't the only reason he was mad. The immediate reason he was mad was because he caught a member of the National Security Administration, he saw him lying to Senator Wyden on national TV, right? When Wyden asked, you know, is the NSA spying on millions of Americans? And he said, no, not wittingly. That was the immediate thing. But yeah, I think it really did require... Look, if we had a government that just came clean with us and said, look, we think we need to spy on everybody in order to keep us safe. And we could have had a big public conversation about that, you wouldn't need whistleblowers. But in a self-governing society, it's not okay for the government to do massive spying and then lie to the American people about it.
Completely agree. And so, I'm struck that, you know, back then, it was really the telcos who were sort of the choke point, the place where all of this data gets aggregated. And increasingly, over the last, what, 15 or so years, it's been what we used to call the edge providers, what I guess we now refer to as big tech, are the ones that have this kind of information. So, I've recently been using New York City's urban planner, Robert Moses, as a bit of an analogy, where infrastructure is in fact policy, you know, the roads being built today are in some ways determining the internet of tomorrow. And so, as you think back in your career and where you think your career might take you next, how do we fight against those centralized choke points? If the architecture is the problem, you know, are courts and statutes necessarily even the right tools?
Well, I think we need an all-of-the-above approach to this. We didn't get into this situation because of just architecture or just policy or just law. So, we're not going to get out of it with just one of these things. And in fact, they're mutually reinforcing, right? I think one of the ways that we help build a more decentralized architecture is we attack the laws that are supporting it right now, including things that, you know, I've long cared about, like the way computer crime laws, the Computer Fraud and Abuse Act, are used to try to stop people from creating interoperational tools that can help free us from the monopolies, right?
You know, we've done a lot of work with developers who are trying to help free people from these monopolies who find themselves sued into a smoking hole because of the misuse of things like the Digital Millennium Copyright Act or the Computer Fraud and Abuse Act. So, I think if you're going to look holistically at how we get out of this, you have to actually look at the laws that are getting in the way. And a legal structure that would help facilitate a more decentralized world. And that gets you into things like monopoly, like competition law, as well as the kind of harder things like computer crime law that EFF has long challenged. So, anybody who tells you that we just need to pick one tool and drop all the other tools is not understanding the scope of what we need to do to get to a better place.
That's the bad news. It's not just a pick-one kind of answer. But the good news is there's lots of ideas. It's not hard. New thinking is always welcome, but there's plenty of things that we could do because this hegemony came into existence because of some laws. It became, you know, my friend Cory Doctorow does a bunch of work on this. His latest book, Enshittification, really goes into this a lot about how the backing away from antitrust and competition laws and the redefining it as about consumer prices played a huge role in enabling the tech giants.
The other thing I would point out is it's not like the telecommunications companies aren't still a vector of spying. They are a huge vector of spying. So, we didn't replace one with the other. It's additive. Now, we have two places to think about in terms of reining in the spying. Sadly, again, I wish that I could let the phone companies off the hook, but they still are unwilling to push back against the government in the way that even sometimes we see the tech companies doing a better job.
You know, with the telcos, there's this sort of quirky little narrative that plays out every two to four years where there's a big promise to everybody, including the government, that we are not going to sell precise location data. And then, you fast forward two years and it's really clockwork that it comes out that, oh no, in fact, we are doing that. And weirdly, sometimes they're not even hiding it. Like, it's not hard to figure it out. And I'm always sort of amazed by this little sub-narrative of all this.
Yeah, we sued them over one of the times that they did and then they said they were going to stop and they backed down and, you know, so we were unable to go forward with the case. And then of course they turned around and did it again. And, you know, it may be two years, but I think it actually wafts with some of the political winds, right? If they've got people in charge of the FCC who are more friendly to them, then they do it again and then when the FCC might turn into people who actually care about privacy, then they drop it or at least, you know, deprioritize it. That's kind of the way I see that pattern happening.
And it's really important. I mean, one of the things, and this is kind of legal wonkery, but one of the things that we see, you know, there's effort sometimes in Congress to create a, you know, what they call a comprehensive privacy law. And the last one that they tried to do didn't do a lot of the things that it needed to do. It was very, very insufficient. But one of the sneaky things it did was it took the FCC's authority to regulate privacy away and made the FTC, the Federal Trade Commission, the only place that could regulate privacy. And that's exactly because the phone companies wanted to be able to sell this data and their main regulator, their real regulator, is the FCC. So if they could take this power away from the FCC, it'd be open season for them.
They have that exactly backwards. Because I... By the way, I'm somewhat sympathetic to the telcos because they're looking across the street at the edge providers and going, 'Oh my goodness, it's a free-for-all over there. We want to get in on that.' And leaving aside the moral angle to this, like I can kind of understand a business looks across the street and they want to be able to make money, too. But what should happen is you need all of those large companies regulated by the FCC or something similar to it. Problem in the US is that that sounds an awful lot like the EU's DMA and there's just like a reflexive, oh no, no, no, we can never do that in the US. And boy, I really hope that narrative changes because I think that would result in a much, much more sane regulatory environment if nothing else.
That it could be, but I guess I have a note of caution for you about that. I think I'd like one rule to rule them all and I'm not sure I want one agency to rule them all. And part of the concern about that is we've seen what happens when a despotic president comes in and takes charge of the agencies. You end up with a...
Yeah, exactly. You know, we're seeing with Brendan Carr what a powerful person in charge of the regulatory agency can do when they're deciding that their job is to, you know, demonize the president's political enemies or even people who make fun of him on TV. So, I think we have to think not only about what regulation might look like. I'm not against regulation, but thinking about backstopping a regulatory power with checks and balances that are real.
And that might point to a different direction than a comprehensive internet regulatory agency. To me it points more to a comprehensive internet rule that ordinary people can enforce, private rights of action. I'm a big fan of them and other kinds of things. Again, there's plenty of regulation that we could do with a centralized regulatory agency, but you really have to think defensively about handing that kind of power to anybody.
Fair enough, and I was just more thinking the larger rule set. And by the way, one thing that you didn't mention is that they really have defanged the ability of regulatory agencies to really create policy. And so that's sort of a whole other set of issues.
