← The 404 Media Podcast
The 404 Media Podcast
The Lawyer Fighting Government Surveillance for 30 Years (With EFF's Cindy Cohn)
00:54:52
Loading summary
Transcript46 lines
- [00:01]
A
The pace of change today can be overwhelming. What's most important to pay attention to if you want to be creative, successful, innovative? I'm Bob Safian, host of Rapid Response. Rapid Response is a podcast that cuts through the noise, featuring candid conversations twice a week with top business leaders navigating real time challenges. From the team behind the award winning Masters of Scale podcast comes Rapid Response. Search Wherever you get your podcasts to listen and subscribe,
- [00:35]
B
people would say, are you more worried about the company spying on you or the government spying on you? And I'm like, nobody's offering you that choice.
- [00:45]
A
Hello and welcome to the 404 Media podcast. As a reminder, 404 Media is a journalist owned company and needs your support. Subscribers get bonus episodes, bonus segments, and early access to interview episodes like this one. To subscribe, go to 404 Media Co I'm Jason Kebler and this week I'm bringing you an interview I did with the Electronic Frontier Foundation's Executive director, Cindy Cohen, who recently announced she would be stepping down from the legendary digital rights nonprofit after decades of service as part of a live stream for the eff. I talked to Cindy about her new book called Privacy's Defender, which is a memoir of her work to protect Americans privacy and fight government surveillance. I read a lot of books about tech and I really liked Privacy's Defender, in part because it weaves Cindy's life story through three incredibly important court cases. Rather than being a dry recounting of three complicated and technical cases, Cindy recounts her strategies in each case, the trials and tribulations she was going through in her personal life during each period, and the stakes of each case. As a quick backgrounder for people who might not be familiar, the cases in the book are Bernstein versus the Department of Justice, which was decided in 1996 and established code and encryption as protected speech under the First Amendment. That was a lasting decision that became really critical in Apple's lawsuit against the FBI in the aftermath of the San Bernardino shooting, when the FBI wanted Apple to decrypt the shooter's phone. The book also follows EFF's lawsuit against at and T for building a secret backdoor in its Internet data centers that gave data to the NSA for warrantless surveillance against American citizens. That was a case that was built in part around testimony and documents shared by Mark Klein, who showed schematics and design documents for secret surveillance rooms in at&T's offices. And finally, it follows the Alphabet cases, which were lawsuits against the FBI for gag orders related to national security letters which are secret demands for customer information that came with gag orders against Internet companies that prevented them from disclosing the fact that the FBI approached them for information at all. This, as Cindy talks about, really exploded in the aftermath of 911 and the patriot Act. And those cases concerned both Cloudflare and a telecom company called credo. And those cases went on for many years. My interview with Cindy shows that the fight for privacy happens in fits and spurts and progress is rarely linear. Without further ado, here's my interview. At the beginning of this book. In the preface you note EFF has done much more work than the stories I tell here. We helped ensure that the first and Fourth Amendments apply online, although there's much more work to be done on each. We helped set a high bar for attempts to unmask anonymous speakers in online forums to stop intimidation by litigation. We've consistently supported Section 230, a law that protects the intermediaries that everyone needs in order to speak and share information online. It goes on and on and on. Dozens of things that EFF has done over the years. I feel like I could go on about the things that I've talked to you guys about over the years. I'm very curious. How did you decide to focus on the three court cases that you talk about in the book, which are Bernstein versus Department of justice, which established code as speech, a very massive case against AT&T wiretapping for the NSA, and then the National Security Letters cases where a telecom company called CREDO fought a gag order. How did you decide which cases to focus on?
- [04:26]
B
I mean, there is another version of this book where I kind of talk about some of our copyright work, some of the work on coders rights and other things. And at some point it, it became clear that the book would be stronger if it had one through line. And privacy is really the through line of all the work. But it also just seemed to me in looking back there was a lot of good stories inside each of these sets of stories. And they also really, I think, provided a nice narrative line of the work. And it really all circles around privacy and it just, it became the central thing as I started looking back at the stories.
- [05:04]
A
Yeah, so the book starts with Bernstein versus the Department of Justice, which again established code as speech. That was very early in your career, as I understand it. And this is like, I think of this as a super critical, like bedrock case that came up most obviously in my own work when I was writing about Apple versus the FBI and you know, the FBI trying to force Apple to decrypt the phone of a mass shooter, that was like a very unmitigated win that's proven to be extremely enduring. But then you end the book on this credo National Security Letters case where you were able to get some concessions, but the outcome was like, a lot murkier. It took many years. It was very hard fought. And I guess just wondering, sort of, how do you think about the nature of progress in this space when you're going up against the federal government and usually like the national security apparatus?
- [05:58]
B
Yeah, it was a good, clean win in Bernstein, and it's endured. I mean, look, we have a lot more to do to secure the Internet, but that win has endured and has allowed encryption to be embedded into so many things that we do. And we were the first to stand up with Apple when they said we're not going to dumb down the security of our devices. In the case where the FBI was demanding that they do. So I kind of tell the companies we're like their frenemies, right? If they stand with their users, we'll stand with them, and if they oppose their users, we're the first in line against them. And that was a, you know, we're highly critical of Apple sometimes, and that was some a time when we got to stand with them. But it's true that the second two sets of cases really are a lot more normal about how these fights go. And especially normal, I have to say, since the 911 attacks, there was a switch that happened in this country with those attacks where it became harder and harder to tell the federal, to tell the government, to tell law enforcement no when it wanted a new power or when it wanted to extend our power. And that's especially true in national security. But it also kind of drifted down to federal and even state and local law enforcement. And I think as a society, that has made those cases much harder. It's made Congress more timid, it's made the judges more timid in addressing those situations. So it's, it's created some, some bigger hurdles for us. But, you know, so it, instead of having a good clean win that looks like, you know, maybe a TV show where the ragtag team of lawyers and hackers win, it's really more like chipping away at this big fortress again. I think that the Patriot act and the post 911 shift in both the culture and the way things work has made it a harder fight.
- [07:46]
A
Yeah, I was a little bit, I guess, not surprised, but I didn't quite understand that in some of these cases, um, you Know, you had a very sound legal argument. And then in. In some cases, like the judge seemed to. To kind of go along with you, and then for reasons unknown, like decided to side with the national security apparatus. I mean, did that leave you wondering about sort of the motivations there, what was maybe going on behind the scenes?
- [08:16]
B
Yeah, absolutely. And in the NSA spying cases, we knew at least that there were secret briefs being filed. Sometimes I'm not sure we knew the whole ext. But the government would actually tell us not what they said, but that they had said something secretly. In the national security letter cases, we don't really know. I don't know how much that has to happen. I think that we've just seen courts that kind of start off applying the regular rules around the First Amendment or the Fourth Amendment. They just kind of get a little timid when it goes up against the national security infrastructure. And it may not be that there's somebody putting pressure on them as much as the pressure is coming. And, you know, it's a. It's a hard thing to do, to stand up to the national security folks and say, you know what, we think you're overblowing this. Or we think the balance between people's rights and what little steps you might gain to be able to investigate crimes, it's just not worth the trade off in terms of people's rights. And I just think we've. Part of this book is kind of a call to courts and Congress members to have a little more backbone because all the rest of us depend on them standing up.
- [09:29]
A
Yeah. So I've seen this fight from newsrooms, like, as a journalist, and I feel like there's a bit of a symbiotic relationship between journalists and organizations like the eff, where often we are reporting on something that's really contentious or sometimes classified or highly sensitive, and we need to make the decision as a news outlet. Like, when do we feel comfortable running a story? Like, is the sourcing sound enough? And in this NSA, AT&T case, like, you talk, you talk about it from the other side, and I've never heard it talked about from the other side before. And I found it to be incredibly interesting because you basically talk about, like, knowing that AT&T had given a tap directly into their systems to the nsa, but maybe not having enough evidence or enough people to talk about it in court. And there's then this discussion about, well, maybe a news outlet will write about it first before we file, or maybe we should file first. And I was wondering if you could just Talk a little bit about that dynamic because honestly, like, when a big organization files a lawsuit, that that makes it a lot easier for us to report on things because it's like, oh, there's all these documents, there's a. There's a complaint, there's maybe evidence, there's maybe, you know, court records. And that makes it a lot easier. But you have some of that going on on your side as well.
- [10:57]
B
Yeah, I think so. And in the NSA cases, it was especially important and more front of mind. And that's because of the way the classification rules work and the way they were being enforced at the time. Traditionally, if journalists published something even if it was classified, they were not prosecuted. Now we're seeing some changes now, but certainly as of the time we' filed this, we knew based on the Pentagon Papers case that Daniel Ellsberg gave to the New York Times and the Washington Post, we knew that if once the press published it and it was widely available, we would have much less risk if it turned out those documents are classified. And we didn't know when we first got them whether they were or not. So we really wanted the press to go first because we thought it would give shelter to the lawsuit and the work that we were doing if we weren't the ones making it public in the first place. And we also thought there was better legal protection for everybody that way. So it was especially acute. I mean, in general, you know, eff, we're. We don't want to go first. I mean, we can if we have the information, but like, we're not in the news business. Right. We don't get credit for scoops. That's not what we're doing. Like, we really want to take what the news is doing, what journalists are doing, and turn it into real change in the world. So I view our job. I tell this the ff a lot. You know, like, we're not in the news business. It's not our job to race be first to get something up. It is our job to take what the news covers and turn it into real change for the world. But occasionally we have stuff first, and I get that. And we can present it in declarations and evidentiary form and then you guys follow us. That was an especially weird one, especially because, you know, the government was able to intimidate the news out of covering that story for a very long time before it came out. So we were especially anxious that. That we not be out too far ahead of what the public already knew.
- [12:44]
A
Right. We talked yesterday briefly, and you mentioned, you know, you don't aspire to break news, but sometimes you do aspire to be first to file, like first to file a lawsuit. And you weren't first to file National Security Letter case necessarily. ACLU I know, had one as well. But you were very early in that CREDO case. And what I noticed is after you filed that there was like kind of an avalanche of other lawsuits that were very similar. And that that also happened in the AT&T NSA case as well. And I was just wondering if you could talk a little bit about that dynamic because it seems like if you are maybe the first to court, then other people come out of the woodwork and say, well, this affects me too. I'm also going to file a lawsuit.
- [13:30]
B
Yeah, and that happened in both. And by the way, we started off with credo, but we added Cloudflare pretty quickly. So we ended up having two secret clients in the national security let cases. But yeah, with the case against AT&T in the NSA spying cases, we kind of anticipated, I mean, I didn't, you know, ultimately there were like 60 some cases filed against every telecommunications carrier you can imagine. We kind of anticipated something like that would happen. And there being first to file was really important because it meant that we could keep control of all the cases. There's a thing called a multi district litigation process where when there's a bunch of cases filed on the same topic, they'll get consolidated, but somebody has to lead the the parade. And being the first one to file and having had a couple rounds in with our judge at this point, at the point of everybody else filing meant that we were able to keep control of all the cases. And it also meant we were able to get them directed over to Judge Walker in the Northern District of California, which we really wanted because he had, he had shown that he understood the issues in the case and wasn't cowed by the government in the initial ruling. So that was really important for us. And the National Security Letter cases, you're right, that came later. Now the ACLU had already done some amazing work and they'd gotten a great decision, but it didn't go far enough. And so we were trying to claim the next step on the case. And we started, we had the Internet archive as a client first, but the government backed down. And then when CREDO showed up, we were able to get one where the government was, was willing to fight us. And it's absolutely true that once we started winning in the National Security Letter cases, Google brought cases, other people brought, other providers brought cases. Because There were so many national security letters being issued and so many companies under this eternal gag that once we kind of cleared the space and we had a judge very skeptical of it, it really did, I think, give some confidence to other people, including Cloudflare, who came to us directly, but other companies to be willing to stand up to this. Now, some companies, to be fair, were fighting some of these things in secret, and we discovered that later. So we weren't. We were early in terms of the public conversation, but I think a lot of companies were privately bristling at this, and some were even fighting back. It just was all happening under the surface because of the gag orders.
- [15:43]
A
Right, right. So I want to take a step back and talk a little bit about the book. And we are talking about the book, but maybe your process and also, like, what you decided to include and why. And one thing that I really liked about the book is that there's a lot of your personal life in there. It really does feel like a memoir. And you can kind of see how things that happen to you in your life may have affected your work or made you feel more passionate about it. And just to toss a compliment in here, I've. I've read many, many books about technology, and I feel like a lot of them are really dry, honestly. And this. This felt honestly like I was reading a memoir and reading a story. And I guess I'm just curious, why did you decide to include so much about your personal life? Like, you talk about, you know, going through a very hard divorce and then going. Having to be on the Colbert show, which was Colbert Report, which is awesome, probably an awesome opportunity, but happening kind of while you were going through this really difficult time.
- [16:44]
B
Yeah, you know, I, I think there's a couple of reasons. One is, I am actually a practitioner. Like, I did this, and I felt like that a lot of the really amazing work that journalists and academics do around privacy, see, is. Is, you know, it only reaches a certain audience. And. And because I had a different perspective on all of this, I thought I would tell it in a first person narrative and maybe make some of these ideas a little more accessible to people who, who aren't already, you know, kind of as obsessed with this stuff as, as, like, you and I are. And, and then once I started talking about it, I thought, well, I needed. I got some good advice that, like, I should talk about why I care about privacy so much. So I kind of started looking back in my life and pulling out the threads. Right. That led me to be somebody who's so passionate about this. And then I think the other thing that I was trying to do is, like, I've lived my life doing this, and some of the work that I've done has really fed into my personal life, that these. These things, they get intertwined. And I felt like by just telling the professional side of it was kind of giving an overly narrow view of what it's like to do this work for the long run. Because at the end of the day, you know, I say it at the very beginning and the end, I'm trying to recruit. I am trying to convince people that spending your life doing something that you're passionate about, whether it's tech policy or something else, it's a good thing to do, and you can do it. And you don't have to be superhuman. You can do this and have a real life, and interesting things will happen in your life. And so I felt like I had to reveal them. I will tell you, as a privacy advocate, there's a real tension here. Right. I've ended up telling a lot more about my personal life than in. Sometimes I'm. I'm comfortable with, you know, but the writing needed it.
- [18:25]
A
And.
- [18:25]
B
And I think I didn't quite think about it at the time that I was revealing all this stuff to the world. I was just trying to write the best book I could write. So I don't regret it, but it definitely. I've definitely had a couple of moments where I'm like, wow, I really. I. I told a lot more about my personal life than I normally do in a professional setting or otherwise. But.
- [18:45]
A
But yeah, maybe it doesn't come naturally.
- [18:47]
B
It doesn't. And I got some good feedback. I had a lot of help writing this book with editors and supporters, and I really want to call out Rainey Reitman, who used to work at eff, who was my accountability coach for this. And so I got some good perspectives from people about how the personal fed the professional in the story and support for kind of doing it that way. And I think it makes a better book, even if it makes me a little. A little antsy at times.
- [19:16]
A
Yeah. Yeah. Another thing I really liked was that there's a little bit of kind of like play by play in terms of how you put these cases together and how you made arguments and your process. As a lawyer, which was interesting to me, as someone who is not a lawyer, but has read lots of court documents, you talk about finding where the fight is, I believe is your terminology. Can you just, like, explain that a little bit? Because I found that to be not. Not just useful, maybe for someone who wants to fight a court case, but also just someone who's trying to make, like, a hard decision or, like, analyze a problem.
- [19:52]
B
Yeah, I. I took this. This strategy from a guy named Jim Brosnahan, who's a legendary lawyer in the Bay Area who actually helped us with Mark Klein back in the day. But, yeah, it's. It's actually very analog. Right. I wish I had one here. I don't. But I, I, you know, I take a legal pad and I turn it sideways, and I write out all the arguments that the one side has and all the arguments that, you know, you get three briefs in a normal motion. There's an opening brief, an opposition brief, and a reply brief. So the moving party, which would be us, if we're the plaintiffs, write the first set, the opposition. What you get from the government comes in, and then you get a chance to reply, and then you do oral argument. And I actually lay them out horizontally against each other and pull out what are we actually saying to each other? What is the core of the arguments? What are the core cases that are cited? And line them up horizontally so you can see what are we saying? What are they saying? What do we say in response? And then what do we want to. What are the most important things that we want to focus the court on when we get to oral argument? And I just find it really clarifying and. And helps kind of cut through some of the bluster and the muster and some of the kind of, you know, things that can happen in when people are writing their arguments to the actual core argument. And it's a. It's a technique that I still use. I use it, you know, when I'm writing things, but also when I'm helping prepare people for oral argument. And I think it just, again, finding where the fight is, you find where people are talking past each other, you find where people are actually addressing the issues. It's just a. An analytical tool to help you figure out, you know, where are we actually fighting in. In these things? And quite often, you discover that you're. You're not really fighting at all. You're talking past each other. And just even recognizing that can help you figure out how you want to explain to the judge what's going on and what they should do with this situation where people are talking past each other. Because at the end of the day, the person who's reading all these briefs is another human being who's trying to figure out what the right thing to do is at least a good judge is. And so you want to help them, you want to advocate for your side, but you also want to help them by not getting them caught up in little side eddies, but really getting them focused on the main things.
- [22:25]
A
Hiring to feel like a full time job on its own I saw a stat recently that the average employer has to sort through something like 250 resumes for a single role. And honestly, in my experience it's often a lot more than that. That's a lot of time just trying to figure out who's actually worth talking to. Well, if you're hiring, here's good news. You can now review all of these resumes and applications faster thanks to ZipRecruiter. ZipRecruiter has a new feature that instantly shows you the most interested qualified candidates first and today you can try it for free at ziprecruiter.com 404 Media what makes that feature so useful is you're not just getting a random list of applicants anymore. With ZipRecruiter's matching technology, you're already seeing people who fit the role. And with their new feature, qualified candidates who are very interested in your job show up right at the top so you can focus your time where it actually matters. You can even get a better sense of who someone is because candidates can tell you in their own words why they're interested in your role. No wonder ZipRecruiter is the number one rated hiring site based on G2. Cut through the standard and get to the standouts with ZipRecruiter. Four out of five employers who post on ZipRecruiter get a quality candidate within the first day. And now you can try it for free@ziprecruiter.com 404media that's ziprecruiter.com 404media meet your match on ZipRecruiter. You've seen the buzz, but let me give you the inside scoop. Live shopping on whatnot is exploding right now. I've watched the shows, I've seen it climb the app store rankings. And when you look at the seller side, it's not just hype. Small sellers, mid sized businesses, people are pulling in serious revenue. It's real. And if you're selling anything right now, you already know the problem. You list something online and then you wait or you open a store and you hope people walk in. Whatnot flips that completely on whatnot. You go live and sell directly to people in real time. You show the product, people jump in the chat, ask questions, bid, and then they come back to your next stream. I was at a wedding the other day and three different people there brought up Whatnot without me even asking. Whatnot is the largest dedicated live shopping platform. Everything from collectibles to electronics to fashion, even food and sellers are building real businesses there. Buyers spend over an hour a day in the app. They're not just scrolling, they're buying. And here's the big thing. People selling on whatnot sell 10 times more than on other major marketplaces because you're not just listing products, you're building real connections across the platform. The number of sellers making over a million dollars a year has doubled. Some make more, some less. But the opportunity is there. If you show up consistently and for a limited time, Whatnot will match your first. $150 sold in the first month. Visit whatnot.com sell to start selling. That's W-H-A-T N O-T.com sell whatnot.com sell. Okay, so let's talk about your reason for writing the book. I'm here to recruit you to sort of like get people to join in this fight and to bring up sort of the next generation of privacy defenders and anti surveillance violence activists and so on and so forth. I'm curious, like, I feel like privacy is having a moment again. I feel like it's one of those things that waxes and wanes and, you know, obviously after the Snowden revelations like that, that's sort of when I started being a tech journalist. And I was like, wow, everyone cares about this. And I, I kept caring about it and then I felt like it kind of like fell off the map. And then more recently, we have, you know, companies like Flock, we have ICE surveillance, we have Ring. And I feel like privacy is having a moment again, thankfully. And I'm just curious, how's the recruitment going? What is your strategy here besides writing a book? What do you think is going on now with sort of the next generation of people who are fighting this fight that you've been doing for so long?
- [26:21]
B
Yeah, I think, I mean, I think people have been passionate about privacy overall, but the thing that they're scared of has shifted. So, you know, in the 90s, we were, we were very focused on the government because the Internet was new and we didn't have the surveillance business model yet. Now that we have the surveillance business model, people for a while were very focused on consumer privacy, the privacy vis a vis the companies. I mean, I've always felt like it was kind of A false choice. People would say, are you more worried about the company spying on you or the government spying on you? And I'm like, nobody's offering you that choice. The government uses companies to do this. It's a fake choice. And it puts people at odds with each other when we should all care about privacy in all the ways. And now I think people are starting to really see how the government is marshaling all the information it has about us, both directly, you know, like the IRS information going to ICE and indirectly, because the government is the number one purchaser of commercial data broker information. So they're really coming together, and they're coming together in the ways that people can see. And, you know, when they're sweeping up your neighbors, they're using commercially available location data to be able to identify where they're going to do the sweeps. And we have testimony about that now from a case in Oregon that I think you guys broke news on. So I think people are really starting to see the effects of surveillance, and that's why it's front of mind again. So in terms of recruiting, you know, I'm hearing from a lot of people about the book. EFF continues to hear from people, but we're also seeing people show up at their local Board of Supervisors or their local HOA or, you know, when states are considering things at much greater numbers than we used to, we still need more. I think that one of the things that the companies and the government have successfully done for a lot of people is convince them that it's futile, that there's nothing they can do, and that they should just give up. But we're increasingly seeing people say, like, that's not okay. And especially not okay when they're. When they're sweeping in and picking up my neighbors and shooting people who are trying to observe the police. Like, we need. We need to get a handle on this. And so I think people are more concerned. It's one of those weird things when you're a privacy lawyer. Like, people are really concerned because things are really bad. And then when things get better, people get less concerned. So we're in a moment, but we're not in a moment because I'm really happy about it. We're in a moment because it's becoming so clear that lots more people are getting energized. So I'm hoping that the book comes at a good time to try to encourage people to get involved, but also to think about. There's kind of two categories that I'm thinking about, and it's people who get involved, you know, they have a day job or they're doing something else and they get involved at night with a local group that is fighting for privacy. But it's also for people who are thinking about how they want to spend their lives and do their careers. And part of the reason I wrote this as my 30 year journey to fight digital surveillance is to try to encourage people to think about this as something they can do for their whole lives. Because we get better at it when we do it over time. EFF has a staff of lawyers now. If you stick around and you have multiple fights in this, you get better. The Justice Department lawyers stick around for a long time. So we can't just show up once and then leave. We're not going to get better at it if we're not matching them in terms of our experience level. So that's kind of my ultimate, you know, my ultimate audience is the kind of next generation Cindy Cohen who's like, well, should I go for the firm or should I go for this nonprofit? And to try to at least encourage them to think about, you know, the fighting, the good fight as a way to spend your career.
- [29:50]
A
Right, right. I do want to talk more about how the threats to privacy have changed over the last 15 years or so. The cases that you focus on in the book all have to do with federal, well, federal surveillance and I guess encryption. But you know, AT&T obviously commercial company involved there. But I feel like over the last few years, and you just mentioned it, the cape, the surveillance capabilities that law enforcement has have filtered down to state and local police in a big way because of the commercial aspect to so much of this. You know, you have local police buying access to really powerful automated license plate readers, to AI connected cameras, to cell phone location data, to social media monitoring tools and things like this. And some of these things used to only be accessible to the federal government, whereas now there's a lot more of them and it's a lot more accessible to the police. But in some ways I feel like it almost makes pushing back against these a little bit easier because you can push back at a local level or a state level. And I'm curious, like, sort of how you think about that because it's made the fight like a lot, maybe a lot more complicated, but almost like a little bit more accessible in some ways because you don't necessarily have to sue the NSA or the Department of Justice.
- [31:14]
B
Yep, exactly right. And you know, we've leaned into our municipal work where we're partnering with People in places all around the country who are trying to stand up against especially license plate readers like Flock. Motorola also does this. People keep thinking about Flock, and I think that's great, but it's a whole industry and we need to make sure that we're not just taking down one of them. But, yeah, we are. We've leaned into supporting things. We've. We've got a, a new case against license plate readers in California that we brought under state law in San Jose because California has a privacy part of its constitution. And, and so, you know, we're trying to be flexible in thinking about what are the right tools for the job, but also aware we can have some of these fights. And with, you know, it's really, I mean, I feel a little like, Cassandra, we knew that all this national security, mass surveillance stuff wasn't going to just stay, you know, the government would say, don't worry, we're only using this to fight terrorists and in very narrow situations, and it will never be turned on the American people, or maybe they might get incidentally impacted by aiming things at terrorists. And, you know, that wasn't. We didn't believe that at the time. And certainly over time we've seen the same technologies trickle down and be used for a wider, wider range of things. So this was predictable. And we tried to stop it, but we're just too small compared to the forces that are trying to do it. We haven't been able to be as effective as I'd like. I'd like us to be 10 times bigger. EFF has 30,000 members. We should have 300,000 members. And we should. And not just EFF, there's a whole diaspora. But the size of what we're up against, and we're smarter than them, but we, we also need to be a little bigger, I think, in order, a lot bigger in order to really be able to drive things in the same way. But, but yeah, we're, we're seeing this and we're seeing people get really concerned because their neighbors are the ones being swept up. They see this at a level that with some of the national security surveillance, it was pretty. It wasn't visible to as many people. Another thing that changed that was the Dobbs decision, where reproductive justice became something that was very different in different states. And suddenly kind of a much wider range of people were seeing the implications of the mass surveillance that we were doing, both commercial and law enforcement. And so that kind of awakened a whole other set of people to the dangers of this surveillance state that we've built, but it's pretty bad right now. It's definitely the case that the surveillance business model has most of the big tech companies, and the government is well aware of it, and they're getting information from them and directly in ways that really do require us to lean in. I remember there's a famous quote from Benjamin Franklin when the Constitution got passed, where a woman asked him, did we go for a republic or a monarchy? And he said, a republic, if you can keep it. And I think we're in the if you can keep it stage in the United States right now, and that. That requires participation.
- [34:14]
A
Yeah, yeah, we'll dive into the dystopia in one second. But I just. No, but I think people want to hear, because I think a lot of people are maybe feeling a bit hopeless. And it's not hopeless. It is bleak, but it's not hopeless. But I just want to add on to that that we have seen a lot of people, just random citizens and. Or like, really local groups, not necessarily even file lawsuits, but, you know, push back at city council meetings. And they've been able to get contracts, surveillance contracts canceled simply by showing up at a local level. And I think that that is, like, a place where it's a lot more accessible and people can sort of take some optimism from.
- [34:58]
B
Yeah, it really doesn't take very many people if you show up at your Board of Supervisors, especially if you live in a small, small place. I mean, you know, we hear stories from kind of, you know, rural Washington State and other places where, you know, really just a few people showing up at a City council meeting or Board of Supervisors meeting can actually change the dynamic. I mean, it's just this, you know, the smaller the place, the fewer people it takes, and then the bigger. And you get all up to the national, and it can take a lot more people. But, you know, when we were fighting sopa, pipa, which is another EFF battle, like, we shut down the switchboard in Congress. So there are enough of us who care about enough of these issues that we can have an impact federally if we're all pulling together. But it is. Actually doesn't take nearly so much if you're working on a local level.
- [35:44]
A
Yeah. Okay. I guess let's quickly talk about the dystopia. Everything that you write about in the book, or a lot of what you write about in the book, are wins in court, in federal court. You talk a little bit about lobbying and pushing for better privacy legislation with the USA Freedom act, which did roll back some parts of the Patriot act, but was really watered down. And you talk about being quite frustrated with the that process, the sort of the lawmaking process. And I'm curious, you know, the courts have been a pretty good way of pushing back against this, but the courts have been changing recently. And I'm curious, sort of what you think the current state of play is is.
- [36:26]
B
Yeah, I mean, look, there's three branches of government and that's not actually going to change. So we do have to work to make them all better. You know, Congress has been awful on this. Although section 702, which is the law that Congress passed as part of USA Freedom Act. Well, actually even before this, the FISA Amendments act to bring some of the secret surveillance under at least some kind of oversight by the FISA court and Congress. It's up for renewal in April. And that will be front of mind for my colleague India McKinney and Matthew Guarglia and the people at EFF who do this kind of lobbying to try to see if we can get. I mean, I'd like it to go away entirely, but at least get some more checks and balances on it and get that to happen. I mean, I think that right now we have a lot of lower courts that are showing a lot of backbone and even courts of appeal, some of which are showing some backbone, but we have a real problem with the Supreme Court now. So this is why we part of why we brought the San Jose case in state court. Right. Because we want to try some other venues to try to protect people's privacy better. But, you know, I don't want to throw too many rocks at the judiciary as a whole, because I think we're seeing a lot of courage at the lower levels. And, you know, the courts aren't hermetically sealed off from our culture. Right. I mean, it is the case that. But we'll see more bravery if we see more support for the brave people. And so I think it's important for people to continue to pay attention and to continue to recognize where good things are happening, even as we continue to push for more. EFF doesn't lobby, doesn't do electioneering, but there are elections coming up, and I think that that's a time for people to make their voices heard as well. But, yeah, I mean, we're spreading out the strategies that we do to try to make sure that we can still make good change, even if some of the old tools that we relied on when I was just starting out are not as great anymore. And we're also having to defend the institutions themselves. I mean, one of the things that the Trump administration has really done is it's begun to try to attack the tools that we use, not just the thing that undermines some of the accountability that we worked hard to build in. And so we've had to shift a little bit to actually defending the tools as much as defending the issues. We stood with some of the law firms that got attacked by Trump because we know how important it is to have a strong base of pro bono support for making social change in the law firms. We work with these law firms. That might not have been something that we took on in a different time, but we realized how important it was to be able to do the work we do to. To be able do to support the institutions and the pieces, the building blocks that we use.
- [39:17]
A
Last one for me, and then we'll move to audience Q and A. A question I get all the time. Is, is it possible to have privacy at all anymore? Like, people feel in some ways maybe like they can't leave their house, they can't use the Internet without being surveilled in some way. And I understand why people feel that way. I think. Also I write about, like, pretty scary surveillance tools and how they're used. At the same time, I try to tell people, you. You do what you do to. To try to protect yourself, but you can't, like, hermetically seal yourself in your house. Like, you have to live your life. Part of the purpose of surveillance is to make people very scared. And I'm curious, like, how you think about that question of whether privacy is possible anymore and how to protect yourself out there.
- [40:07]
B
Yeah, I mean, I think it's a real legitimate concern. And I think your advice is good, is good advice. I mean, you know, we have to. We're not gonna. I think sometimes these questions of privacy get reduced down to individual choice. Like, you know, how do I protect my privacy and my choices? You know, whether I use a service that spies on me. Like, that's my fault because I gave it away, and so I just shouldn't use it. So it's kind of this, this blaming the victim kind of mentality. I mean, the game is rigged. But also, I don't think abstention will work for most people. There are a few people who are privileged enough in society that they can just unplug and go live in the world, live in the woods, and not use any of these services. But the rest of us need them, and especially people who come from marginalized. You know, you can't Get a job without going online these days very easily. You can't get a mortgage, you can't rent a house, you can't, you can't buy many things that you might want to buy without engaging with the surveillance world. And so the answer has to be we have to kill it. We have to band together as a self governing society and decide we don't like the surveillance business model anymore. We're not going to let them do that. I think you can do that consistent with the First Amendment, although you have to be careful about how you do it. There are tools that can help for sure, but technology, technology, law and policy all have to work together for us to get to this place and culture. So, you know, use signal, use Tor, use all the, you know, all of our friends who are building a more secure, more distributed, less centralized version that doesn't have the surveillance business model. They're great and we support them and we encourage people to support them. But I think, I think sitting all alone in your house and not engaging in the world is what they want, want us to do. And so I don't think we should fall for it. Instead, we should stand up for a world in which we get all the goodies, we get all the toys, but they work for us and not against us. I mean, I love technology. I love it when something comes along and it does something good. I work for the Electronic Frontier foundation, not because I, I hate technology, but because I love it. And I just, I say that too
- [42:16]
A
all the time and no one ever believes me.
- [42:17]
B
I, I just demand a better deal. We should demand a better deal. Nobody, you know, I most Moses did not come down from the mountain with stone tablets that said the Internet must surveil you, right? Like, it's not that baked, it's not even that old. So we can fix it. We just have to have the will and we have to not believe the people who say that there's nothing we can do because that's what they want us to do. And I, you know, if anything else, just be a bit of a little rebel in your heart. I'm not gonna, I'm not gonna succumb to privacy nihilism because that's what they want. That works for, for me.
- [42:51]
A
So there's a question, it's a very nice one. If someone is watching and they want to do one thing, this is the nice part. In addition to joining EFF and subscribing to 404 Media, what would you tell them to do?
- [43:04]
B
I mean, look, it depends on what you're concerned about. I think that if you're concerned about security, install the updates for all your software. That's the best way. That's still the best piece of advice in terms of data breach and things like that. I know it's not sexy, but it is. I think that to the extent you can move a lot of your communications over to encrypted tools, that's one thing you can do. And the nice thing about that is privacy is a team sport. If you can move the communications with your friends over to a signal platform or something else. We're still beating on Apple and Google to make end to end encrypted between Android and Apple devices, but there's a lot of tools that can help you have kind of baseline privacy in your communications, and they're a good first step. I successfully convinced my, you know, as you know from the book, my community is really important to me. I successfully convinced a chunk of my community to move our combo, our group chats over to Signal. And honestly, I did it because our friends who had Android machines kept getting dropped off off the thread and it was really annoying. And so I convinced everybody that we could move to Signal and then nobody would ever get dropped off. We wouldn't have to add people back in again. So my pitch to them wasn't even a privacy pitch, it was a usability pitch. But it worked, right? And that's good. There was a horrible case in Nebraska where a mother and her daughter were prosecuted because they were discussing the daughter's interest in reproductive health over Facebook messenger, which is not end to end encrypted. And it was that information that ended up with the mother. And I think, I think the daughter might not have gone to jail, but the mother ended up going to jail for facilitating an abortion. And if that same communication had happened over Signal or over WhatsApp or over some encrypted messaging, that might not have happened. It might have come out very differently. So just that one thing you can do, and you may not know the thing that it protected you against or your friends against, but remember, it's not just your privacy that you're thinking about. It's everybody who's in your contacts list, everybody you communicate with, and they may have different risk factors than you do. Sometimes people say, you know, I have nothing to fear, so I have nothing to hide, so I have nothing to fear. And I always kind of encourage them to think about all the other people in their lives and whether that's true for all of them, because we literally have each other's privacy, you know, in, in our hands.
- [45:31]
A
Yeah. And I can't. There's been multiple times when I have talked to someone who has been wrongfully arrested or subject to surveillance who said, I thought I had nothing to fear because I wasn't doing anything wrong. And then there you go.
- [45:44]
B
Yeah. And it changes fast. Right. I mean, this is one more thing is if you don't feel like you're in the crosshairs now that that may not be the case in the future. You know, I don't think I would have told you that observing the police would end up with people, you know, being surveilled and tracked or monitored the police. But we're starting to see that. Right. There's a terrible case in Maine where, you know, basically the ICE agents identified where somebody lived who was observing them and used that to intimidate them. So even if you think that could never happen to you, I worry that that may be true today and not true tomorrow.
- [46:16]
A
Right. This is a question from Carl Rossman. I'd love to hear about how EFF has changed over the years and where it's going in the next decade.
- [46:26]
B
Well, it has changed a lot over the last years. I mean we're 125 people. When I joined EFF, we were probably about 15, I don't remember. So we have grown and we have developed out like we started. We have a whole technology part of EFF now where we build technologies as well as advising lawyers. That started because when I started at eff, I would call computer science professors and ask them to explain stuff to me. And ultimately we hired an in house technologist to help us navigate this and also help us find resources. His name is Set Schoen. He's still around. And so we built out this technology team first to advise us on policy and law and then, you know, as you learn when you get techs around, they want to build stuff and so they started building things. Our activism team has been built out over time. We've always done a little international work, but we really developed some pretty strong work in Latin America especially and in the eu. As the EU emerged as a place that started thinking about tech policy, we've engaged there more and more. So I would say it's been reactive largely in that we see what the world needs and we kind of go in that direction and that's kind of how we've tended to do things. And we've got. We're a much more diverse team than we were when we started. You Know, kind of as the Internet has grown and become more diverse than the kind of. I mean I love all those early hackers who showed up at the hearings with me, but they all were kind of guys and you know, of a certain class and generally white and the Internet isn't that anymore. And so our staff looks a lot different and the issues we work at and the groups that we work with look a lot different than it did in the 90s. And I think that will continue to change. I mean as the Internet presents us with new issues, we try to figure out how best to use our skills to meet the moment. And sometimes we add skills as well. I don't know about the next 10 years. Obviously AI is everywhere and we have been thinking about it and doing some work on it in various areas for a while. I just don't think there's any way to avoid kind of taking those issues on as they come up. And we will continue to do that. I'm going to be leaving EFF in June. I feel like think it's time to pass the torch to the next generation. So what EFF becomes in the next 10 years will be a lot about as it always is. It's never. EFF isn't a top down organization, it's bottom up. And so the people who are here and our community will determine, you know, will help determine where we go next.
- [49:09]
A
We have two questions that are kind of advice questions. I feel like we touched on them a little bit but I'm going to ask them anyway in case there's anything else to add. What can I do to protect my privacy online? Where can I go to learn more and get involved? You mentioned groups, people to get involved with. I was given permission to answer some of these questions as well. So I mean I would Recommend Definitely following DEFs work. Follow our work 404 Media. We write about privacy all the time. But there's a lot of other really great organizations like the center for Democracy and Technology, the American American Civil Liberties Union, obviously epic, which is Electronic Privacy Information Center. There is. I would definitely try to familiarize yourself with different cybersecurity like how to keep yourself safe from that perspective. The journalist Zach Whitaker has like a really great newsletter. That's, that's my suggestion. Anything else?
- [50:09]
B
Those are, those are really good suggestions. We work with all of them. And you know one of the things that's nice about the digital rights community is we're all kind of friends and we all support each other and we all try to figure out, oh wait, you Know, if ACLU is doing this, we don't have to do it. We can do these other 10 fights that they can't do. And so we, you know, I wouldn't say we formally coordinate, but we informally do. And they're all great organizations, the digital rights community. And there's internationally as well. There's a group called Access now, but there's also groups all around the world as well. I know we have people who are on this live stream from other countries. It's not just the US Access now has a big conference called RightsCon that's actually happening in Zambia this year. But people from every corner of the world who are interested in digital rights come to that conference or, you know, show support. So there's people all over, all over the place who are doing this. Find the ones who are local. It's not too hard to find. And again, I think we, we try. We have local groups all across the country who are loosely affiliated with efficiency that you can find and that we have information on our website about them. But yeah, finding local folks is great. Again, both EFF and 404 Media deserve support, but there's a lot that you can do from wherever you live.
- [51:26]
A
And then another question. What can I do about being targeted by my local police for surveillance? Veiled threats, harassment? I'm an independent journalist who writes about police accountability. I mean, it depends on the specifics. Obviously, the way that we have sort of handled this is by really, really informing ourselves on our rights as journalists. You know, you have to be quite careful kind of about how you gather information and that sort of thing, but also kind of knowing what you're allowed to do and what you're not allowed to do, first and foremost. And then, and we are kind of thankfully, have, have our own lawyer that we can like run things by and that sort of thing. I know that's out of reach for a lot of people, but I know that there's a lot of organizations that do pro bono work and help out from that perspective, but curious if you have anything to add there.
- [52:20]
B
Yeah, you know, look, if you have real legal adviceinfoff.org is our intake. There is a person there who will get your email and help if we can't help you, help you find counsel. We have a very strong list of cooperating attorneys who help people. Some pro bono, some low fee, sliding scale, some full freight depending on what you need. So. And you really do need somebody to talk individually with you about what your threat model is, what's going on. So I would really recommend that. Another group that, that, that tracks a lot of this is the Freedom of the Press foundation, which was kind of launched a little out of eff. I talk a little bit about some of that is in the book. And they're also another good place that is tracking harassment and issues involving journalists. So they're another one I might name check around that. But there's the Committee to Protect Journalists. There's a whole set of journalistic support organizations as well.
- [53:16]
A
I think that's all we have time for at the moment. Thank you so much, Cindy, for doing this and also for writing the book. Just a last plug and. But it's a good book. Please read. Was fun to read. I felt like I had known a fair bit about these cases, but I learned so much more. I think it's also very accessible. If you are at all interested in this topic, you'll be able to follow it. It's not overwhelming. So congratulations on writing a book that I think appeals to technical experts, but also people who are just getting interested in this topic.
- [53:52]
B
Thank you. And I will tell you that my, my publisher said people should write reviews. So if you like it, they, they say write reviews on, you know, Amazon or wherever you get the book because that helps spread the word. And I'm not a professional promoter, but I have been told that that is a good thing to say. So I'm also working on a little book tour. If you go to eff.org privacydefender you can see where I'm gonna be in the next couple of months. But so if you want to come out, say hi, that would be great as well. And I sign books and things like that.
- [54:24]
A
Thanks so much for listening. This episode was produced by Kaleidoscope and edited by Alyssa Midcalf. We'll be back with a new episode in a few days.
- [54:43]
B
There's fishing and then there's fishing. Out here. You're after dinner. Online hackers are after your data. They'll bait you with fake emails, look alike sites, anything to lure you in. But with Cisco Duo's end to end phishing resistant access control. Every login, every device, every user stays protected. Looks like no one's biting today. Cisco Duo fishing season is over. Learn more@duo.com.