[00:05.970 --> 00:06.410]  Hello!
[00:06.410 --> 00:07.670]  Are we all having fun?
[00:09.870 --> 00:10.310]  Awesome.
[00:10.430 --> 00:19.730]  We're streaming in so many places, it's hard to keep track, but we're next door, we're down there, we're downstairs, we're across the world on our network.
[00:20.110 --> 00:25.590]  Which, by the way, I don't know if you guys heard about this, we had a denial of service attack last night.
[00:26.350 --> 00:26.950]  Yeah.
[00:29.450 --> 00:35.290]  And it registered to maybe just under a tenth of what our bandwidth can sustain.
[00:40.530 --> 00:41.490]  No, no.
[00:42.270 --> 00:44.550]  I applaud the effort, I really do.
[00:46.530 --> 00:50.850]  And if you go to the HOPE NOC Twitter feed, you'll see the spike.
[00:51.270 --> 00:55.070]  But the very first comment was advice to them, use more bandwidth.
[00:57.810 --> 01:04.870]  Which, guys, use more bandwidth, we have so much, we have 10 gigabit more than any other conference, I think, has.
[01:05.630 --> 01:06.870]  And it's up to us.
[01:07.150 --> 01:08.930]  You know, we are really nice people.
[01:09.010 --> 01:13.310]  The very fact that Donald Trump's website is still operating is proof of that.
[01:14.050 --> 01:14.150]  Okay?
[01:18.030 --> 01:20.950]  I mean, think of the power we have in our hands right now.
[01:21.090 --> 01:22.910]  Think of what we could do if we were evil.
[01:22.910 --> 01:25.490]  And we're not, but just something to keep in mind.
[01:28.650 --> 01:32.710]  We want everybody to have fun, but we don't want everybody to have irresponsible fun.
[01:32.890 --> 01:36.150]  There were some people last night that were exploring the roof.
[01:36.250 --> 01:38.730]  I know everyone likes to explore the roof, but don't do it here.
[01:39.050 --> 01:45.150]  Because if you do it here, the cameras will catch you immediately, and hotel security will be on you, and we can't help you at that point.
[01:45.150 --> 01:52.690]  Last night, one of our security guys was able to save a bunch of people from the NYPD, who were on their way up with tasers in hand.
[01:53.410 --> 01:55.270]  You don't want that, believe me.
[01:55.590 --> 01:59.950]  And you'll lose access to the conference, there's nothing we can do to help you at that stage.
[01:59.950 --> 02:04.630]  So please, explore New York City, you know, do whatever, and hang out at the conference.
[02:04.870 --> 02:06.410]  But please don't be irresponsible.
[02:06.770 --> 02:10.550]  And if you see people acting like that, let us know.
[02:10.550 --> 02:15.410]  And we'll deal with it in a humane way before things get out of hand.
[02:16.750 --> 02:18.650]  There's no bull on the roof, trust me.
[02:22.810 --> 02:27.470]  Okay, last night we had our first open mic session, which we haven't done before at midnight.
[02:27.630 --> 02:29.810]  It went really well, we were there until 2 in the morning.
[02:30.510 --> 02:36.110]  Tonight we have a new feature called Hackers Got Talent, and it's going to be a lot of fun.
[02:36.850 --> 02:44.830]  We have a special prize for the first place, we only have room for 11 contestants, believe it or not.
[02:46.170 --> 02:55.550]  So, you get about five minutes a piece to, I guess, show your talent relating to hacking, whatever that might be.
[02:55.630 --> 03:03.950]  It could be a comedy bit, it could be solving a Rubik's Cube really fast, it could be displaying something on screen, what you can do with a computer.
[03:04.590 --> 03:10.430]  Sign up downstairs at the info desk, and show up at midnight in the room next door.
[03:11.110 --> 03:12.910]  No through, I believe is what it's called.
[03:12.910 --> 03:21.130]  We have as first prize, a little gift bag from Mr. Robot, who was very kind to us this year.
[03:21.790 --> 03:22.390]  What do we have?
[03:22.390 --> 03:23.730]  We have a Mr. Robot hoodie.
[03:25.090 --> 03:27.630]  And we have, of course, the F Society mask.
[03:29.850 --> 03:33.070]  There's only one of those here, so that's something to keep in mind.
[03:33.170 --> 03:33.610]  What else we have?
[03:33.790 --> 03:35.030]  Earbuds that Elliot wears?
[03:35.250 --> 03:36.890]  Not the actual ones, but...
[03:36.890 --> 03:37.850]  They look fancy.
[03:38.010 --> 03:40.570]  They look really cool and fancy, and people will move away from you.
[03:41.130 --> 03:42.310]  What else we got in there?
[03:42.710 --> 03:43.550]  Anything else?
[03:43.730 --> 03:47.810]  We have, yeah, we have some FSociety flags, and all kinds of fun things.
[03:47.950 --> 03:47.950]  Diplomatic.
[03:47.950 --> 03:48.910]  Very diplomatic, yes.
[03:49.130 --> 03:52.930]  So that's yours if you win, and with 11 contestants, you have a good shot.
[03:53.130 --> 03:57.870]  But you gotta sign up downstairs, info desk, for Hackers Got Talent tonight at midnight.
[03:59.250 --> 04:00.310]  Tons of other talks.
[04:01.010 --> 04:05.910]  We got, Russ Albrecht's mom actually is here, from Silk Road.
[04:06.710 --> 04:08.930]  Well, she didn't come from Silk Road, but she's here.
[04:12.170 --> 04:18.410]  And, you know, I'm really, I'm very proud of you guys for supporting her efforts to get the word out about her son.
[04:18.830 --> 04:22.150]  She's got a table downstairs, but she has a talk, what time's the talk?
[04:22.150 --> 04:23.410]  It's 5 p.m.
[04:23.430 --> 04:24.590]  5 p.m.
[04:25.010 --> 04:28.810]  in Hoover, which is the room, the fourth track, the unscheduled track down in the hall.
[04:29.310 --> 04:34.230]  So by all means, check that out if you have a chance, and aren't at any of the other tracks that are going on.
[04:34.870 --> 04:41.790]  So now it's time for our keynote, and I am just so excited that we finally have Cory Doctorow here.
[04:41.990 --> 04:46.690]  We've been trying to get him for many, many years, and scheduling always has made things difficult.
[04:47.810 --> 04:50.050]  But Cory is one of those amazing people.
[04:50.190 --> 04:51.750]  I don't know how he does it.
[04:51.890 --> 04:52.750]  He writes fiction.
[04:52.930 --> 04:54.070]  He writes non-fiction.
[04:54.410 --> 04:55.550]  He blogs.
[04:55.870 --> 04:57.350]  He's an editor at Boing Boing.
[04:57.490 --> 04:58.910]  He works with the EFF.
[04:59.510 --> 05:05.430]  You know, I had a theory that there's got to be three of him to do all the things that he does, and so well.
[05:06.870 --> 05:14.910]  So to have him here speaking in New York at the HOPE conference is one of our highlights, I think.
[05:15.530 --> 05:25.570]  He will be signing books downstairs afterwards, I think around 3 o'clock or so, 3.15, at the OR Books vendor table.
[05:25.610 --> 05:27.750]  So I think we only have about 20 of those.
[05:27.930 --> 05:30.610]  So come on down afterwards and get your book signed.
[05:32.330 --> 05:37.930]  And I don't want to go into a whole lot of biographical material because there's so much of it and it would take a half hour.
[05:38.930 --> 05:40.510]  But Cory Doctorow is here.
[05:40.710 --> 05:44.350]  I want to welcome him to our home and prepare to be amazed.
[05:44.830 --> 05:45.190]  Thanks.
[05:49.300 --> 05:49.880]  Thank you.
[05:50.020 --> 05:51.100]  Thank you all very much.
[05:51.240 --> 05:51.820]  Thank you for coming.
[05:51.960 --> 05:52.520]  Thank you, Emmanuel.
[05:53.540 --> 05:54.720]  Oh, you've got the slides up.
[05:54.820 --> 05:55.200]  There we go.
[05:55.580 --> 05:56.480]  So, hi, folks.
[05:56.680 --> 06:00.560]  It's a genuine pleasure and honor to finally get to HOPE.
[06:00.560 --> 06:03.840]  I've been trying to come, as Emmanuel said, for more than a decade.
[06:04.020 --> 06:10.880]  I've had, like, planes canceled and been kidnapped by my wife for my birthday weekend and lots of other reasons I haven't been able to come.
[06:10.920 --> 06:17.240]  And it's such a pleasure and an honor to be here at HOPE in New York after all these years of admiring it from afar.
[06:17.360 --> 06:19.300]  I'm reading 2600 since I was a teenager.
[06:20.480 --> 06:25.320]  So after this talk, just as a heads up, they've given me a really big generous block of time.
[06:25.320 --> 06:26.880]  So there's going to be lots of time for Q&A.
[06:27.540 --> 06:28.780]  There's an audience mic.
[06:28.980 --> 06:34.880]  And I like to alternate between people who identify as female or non-binary and people who identify as male or non-binary.
[06:34.920 --> 06:36.500]  So I'm going to call on you in that way.
[06:36.640 --> 06:39.180]  A heads up now to start thinking about questions.
[06:39.640 --> 06:41.940]  Long rambling statements followed by, what do you think of that?
[06:42.520 --> 06:44.180]  Technically a question, but not a good one.
[06:44.180 --> 06:47.380]  So just start...
[06:48.200 --> 06:48.760]  Yeah.
[06:49.760 --> 06:50.740]  Start thinking about that.
[06:52.040 --> 06:57.720]  So as you can see from the slide here, I want to talk today about different kinds of arguments.
[06:57.960 --> 07:07.400]  Because in the world of information security, hacking, civil liberties, technology, we have a lot of serious, deep, significant, good faith arguments.
[07:07.500 --> 07:16.260]  Arguments about whether or not we should be stressing the utilitarian instrumental benefits and calling it open-source or the moral benefits and calling it free software.
[07:16.460 --> 07:19.100]  Those are good, meaty arguments to be having.
[07:19.360 --> 07:21.620]  But there's a different kind of argument.
[07:21.880 --> 07:24.420]  The denialism kind of argument.
[07:24.880 --> 07:32.800]  These are the debates that are manufactured by people who profit from controversy over something that's not actually controversial.
[07:33.440 --> 07:36.340]  And the canonical example of this is smoking.
[07:37.560 --> 07:43.020]  The cancer denial movement was kind of the template for all the denial movements that followed.
[07:43.080 --> 08:00.960]  And, you know, if cancer was kind of the warm-up, the kind of mega-death that followed on cancer from denialism really showed that there was like no limit to how many people's lives you could destroy just by pretending that something that was true was instead controversial and unknown.
[08:01.380 --> 08:05.280]  You know, the AIDS denial movement was a particularly toxic version of this.
[08:05.420 --> 08:13.200]  There was a German doctor named Matthias Roth who owned a big vitamin company and who claimed that AIDS wasn't caused by HIV.
[08:13.200 --> 08:15.780]  He claimed it was caused by vitamin deficiency.
[08:15.920 --> 08:24.120]  And he ran these ads in South African newspapers saying things like, why should South Africans continue to be poisoned with AZT?
[08:24.400 --> 08:25.760]  And that would be bad enough.
[08:25.760 --> 08:30.400]  But he was a crony of the president of South Africa at the time, Thabo Mbeki.
[08:30.680 --> 08:43.500]  And they adopted the official policy along with the South African Ministry of Health that AIDS was a vitamin deficiency and that antiretroviral drugs would not be the standard treatment for AIDS in South Africa.
[08:43.780 --> 08:48.340]  And because it was a vitamin deficiency, it also wasn't treated as a sexually transmissible illness.
[08:48.340 --> 08:52.120]  And so during that period, 300,000 people died.
[08:52.300 --> 09:06.260]  And the population of HIV positive people, which started at 1% in South Africa, by the end of this, by the time they recognized that AIDS denial and that AIDS was the expression of HIV, that population went from 1% to 25%.
[09:07.340 --> 09:17.600]  And, you know, part of the kind of playbook for denial is that when people say that the thing that we know is true is true, you have to silence them.
[09:17.900 --> 09:26.120]  And so when Ben Goldacre wrote this up for The Guardian, he's an eminent epidemiologist, when he wrote it up for The Guardian, Matthias Roth sued him for libel.
[09:26.460 --> 09:32.280]  And The Guardian spent hundreds of thousands of pounds and eventually prevailed and were able to publish this story.
[09:32.560 --> 09:38.420]  And so that is a kind of template we see over and over again in public debates.
[09:38.420 --> 09:49.680]  The kind of bad faith argument where experts all agree that something is true and yet in some important official circle we act as though it's still an open question.
[09:49.980 --> 09:52.320]  So, you know, you know about climate denial, obviously.
[09:52.620 --> 09:59.460]  But there's another kind of denial that this community has to deal with extensively, and that's a Turing completeness denial.
[10:00.140 --> 10:00.700]  So...
[10:02.140 --> 10:04.660]  It's a funny name, but it's real, right?
[10:04.720 --> 10:07.300]  And so there are a lot of expressions of Turing completeness denial.
[10:07.300 --> 10:17.260]  The denial that, like, computers can run all the programs that we can express in symbolic language, that we don't know how to make a computer that can run all the programs except for the ones you don't like.
[10:17.960 --> 10:26.320]  So, you know, a good kind of long-running example of this, and one that I'm going to return to in this talk a few times, is digital rights management or digital restrictions management.
[10:26.340 --> 10:45.220]  So the idea that you can build a computer that you can send a ciphertext to, and then you can send the keys to, and then you can ask the computer to make sure that the owner never sees the keys, and doesn't get to save the clear text when the keys and the ciphertext are combined.
[10:45.740 --> 10:45.840]  Right?
[10:46.040 --> 10:46.580]  That's like...
[10:47.340 --> 10:54.000]  In security, we have a technical term for that security model, where you give the keys to the adversary and then hope the adversary doesn't find out what they are.
[10:54.000 --> 10:55.120]  We call that wishful thinking.
[10:55.480 --> 10:55.880]  Right?
[10:56.160 --> 11:01.200]  Like, if we made the best safe in the world, we wouldn't keep it in the bank robber's living room.
[11:01.520 --> 11:08.740]  And if you make the greatest DRM system in the world, it will fail because you are sending your adversaries the keys.
[11:08.880 --> 11:10.340]  It's not Alice and Bob and Carol.
[11:10.500 --> 11:12.720]  Alice and Bob trust each other and Carol is trying to...
[11:13.420 --> 11:14.720]  man in the middle of their communication.
[11:15.000 --> 11:16.160]  It's just Alice and Bob, right?
[11:16.260 --> 11:19.000]  Like, Bob is Netflix and we're all Alice.
[11:19.000 --> 11:24.540]  And Bob wants to send us a scrambled movie and make sure we can't save it for offline viewing.
[11:25.280 --> 11:33.580]  And anyone who wants to can become Alice just by getting a Netflix subscription, which I know it went up by like a dollar this month, but it's still not hard to become Alice.
[11:33.760 --> 11:48.480]  Alice can be like bored grad students with their own electron tunneling microscopes and a whole bunch of undergrads hanging around with nothing to do like a bad smell, who can just go through the code one line at a time, go through the computer one register at a time until they find that key.
[11:49.060 --> 11:54.060]  And so, you know, DRM fails all the time, but we pretend that it still works.
[11:54.600 --> 11:55.700]  Or crypto backdoors.
[11:55.900 --> 11:58.520]  You know, this is a subject that's everything new is old again.
[11:58.640 --> 11:59.500]  Everything old is new again.
[11:59.640 --> 12:01.180]  We're back to crypto backdoors again.
[12:01.280 --> 12:09.980]  The idea that we know that we can make a crypto system that keeps all our secrets perfectly and forever, except when we need it to fail catastrophically.
[12:09.980 --> 12:15.700]  And then it fails catastrophically just for one minute, long enough for good people to be able to discramble the message.
[12:15.700 --> 12:18.880]  And then it reasserts itself and starts working again, right?
[12:19.020 --> 12:23.000]  We know that that doesn't work if we know anything about crypto.
[12:23.160 --> 12:26.000]  And yet there's like amazingly alive debate, right?
[12:26.140 --> 12:35.940]  People who are serious people who get paid lots of money and get to make decisions, who say with perfectly straight faces that we know how to make that crypto system.
[12:35.940 --> 12:40.040]  And it's just that the nerds are like hiding it from us.
[12:41.060 --> 12:43.120]  Or privacy denial, right?
[12:43.400 --> 12:50.100]  This idea that we can like collect lots of data and retain it indefinitely, and that it won't leak.
[12:50.200 --> 12:52.380]  And if it does leak, nothing bad will happen, right?
[12:52.460 --> 12:54.880]  The idea that if you have nothing to hide, you have nothing to fear.
[12:55.060 --> 13:04.280]  That it's the same thing for you to drive down the street with a car that has a license plate, as it is for that car to have its license plate photographed every hundred yards.
[13:04.680 --> 13:07.080]  And then for those photographs to be subjected to OCR.
[13:07.400 --> 13:10.660]  And then for the records of all the places that you've been to be stored indefinitely.
[13:11.000 --> 13:11.180]  Right?
[13:11.280 --> 13:12.860]  These are clearly not the same thing.
[13:13.020 --> 13:14.840]  And there are clearly harms that can arise from it.
[13:15.020 --> 13:17.360]  And yet we treat them as though we're equivalent, right?
[13:17.360 --> 13:21.800]  We say that everything that's not secret is therefore not private.
[13:22.340 --> 13:25.100]  But there's lots of things that aren't secret that are still private, right?
[13:25.160 --> 13:28.280]  Like I know what you do when you go to the toilet, right?
[13:28.280 --> 13:33.040]  It's not a secret and yet it takes a very special person not to want to close the door behind them.
[13:35.300 --> 13:39.340]  I know what your parents did to make you, right?
[13:40.040 --> 13:45.820]  And yet most of us, you know, it's cool if you don't want to do that in private.
[13:45.820 --> 13:49.020]  But it's not any of my business if you choose to do it in private.
[13:49.240 --> 13:51.280]  Private isn't that no one knows your business.
[13:51.440 --> 13:54.300]  It's that you get to choose who knows your business.
[13:55.620 --> 14:00.280]  And the problem with denial is that it begets nihilism.
[14:01.700 --> 14:06.340]  Denial matters because the things that we deny are real, right?
[14:06.460 --> 14:07.640]  Climate change is real.
[14:07.920 --> 14:09.200]  Cigarettes cause cancer.
[14:09.580 --> 14:11.360]  HIV is not vitamin deficiency.
[14:11.620 --> 14:15.100]  We can't make computers that run all the programs except for the ones that piss you off.
[14:15.100 --> 14:20.640]  And so the non-solutions that are demanded by denial don't solve the problem.
[14:20.640 --> 14:23.660]  And the problem festers and it gets worse.
[14:24.180 --> 14:34.900]  And because we're not solving the underlying problem and yet we're pretending that we're solving the problem, the problem is that our non-solution is actually worse than doing nothing at all, right?
[14:35.960 --> 14:44.180]  It's worse than doing nothing about cigarettes and cancer to think that smoking light cigarettes won't give you cancer, right?
[14:44.300 --> 14:53.820]  Because it takes people who think that they're mitigating their harms and puts them in exactly as much harm's way as they would have been if they'd gone on doing the same thing.
[14:53.960 --> 14:57.200]  It's like having someone whose car has faulty brakes.
[14:57.200 --> 15:03.880]  If they know their car's brakes are faulty, they can take steps to remediate that fault.
[15:04.080 --> 15:05.300]  They can drive more slowly.
[15:05.300 --> 15:06.940]  They can increase their following distance.
[15:07.080 --> 15:12.680]  But if you don't know that your car's brakes are faulty, the way that you find out is in the hardest way possible.
[15:12.940 --> 15:17.600]  So doing... telling people that their problem isn't a problem makes things worse.
[15:17.720 --> 15:20.940]  Worse than if they knew that it was a problem and did nothing at all about it.
[15:21.400 --> 15:30.360]  You know, people who think that AIDS is caused by vitamin deficiency have unprotected sex even though they know that they have AIDS, right?
[15:30.480 --> 15:34.240]  And that's how you go from 1% to 25% infection rate.
[15:34.420 --> 15:38.160]  If you deny climate change, you build houses on floodplains.
[15:39.240 --> 15:43.900]  And then the floods come and it's worse than doing nothing at all.
[15:44.040 --> 15:55.380]  If you deny Turing completeness, then you go around and you tell artists sweet lies about the day that will come when the Internet will somehow be worse at copying, right?
[15:55.380 --> 15:56.900]  That day is never gonna come.
[15:57.120 --> 15:57.800]  This is it, right?
[15:58.160 --> 16:01.600]  July 22nd, 2016, remember this day.
[16:02.000 --> 16:04.700]  Because it doesn't get harder from here on in, right?
[16:05.040 --> 16:10.580]  Your grandchildren and great-grandchildren will marvel at how hard it was to copy stuff in 2016.
[16:11.000 --> 16:26.400]  And will ask you, tell me again, Grandma, tell me again, Grandpa, about 2016, when you couldn't go into a CVS and buy six thumb drives for a dollar, each of which could hold all of the words ever spoken and all the paintings ever painted and all the songs ever sung and all the movies ever made.
[16:26.460 --> 16:36.060]  Tell me when, like, all of the retirees hadn't gone to free classes at the library to teach them the magic incantation, movie name space BitTorrent, right?
[16:38.660 --> 16:39.760]  So this is it, right?
[16:39.860 --> 16:41.220]  Like, it doesn't get harder to copy.
[16:41.320 --> 16:42.700]  And so we go around and we tell...
[16:42.700 --> 16:49.060]  Because of Turing completeness denial, we tell artists that someday it will be harder to copy than it is now.
[16:49.060 --> 17:04.980]  And we tell them that the reason that they get so little money from Spotify is that their audience listens to music the wrong way and not that the billions that streaming services hand over their labels is just intercepted and pocketed by those labels and none of the money is passed on to them.
[17:05.140 --> 17:14.520]  And we end up pointing artists at the people who love their work and not at the people who sit between them and the people who love their work, who take the lion's share of the money.
[17:14.520 --> 17:17.840]  And it's easy to see how that won't solve anyone's problem.
[17:18.140 --> 17:36.120]  Or with crypto denial, we build out infrastructure and we build embedded systems, you know, forever day systems, systems that are never patched, that have vulnerabilities that were deliberately introduced at the time of manufacture in order to allow for lawful interception capability.
[17:36.340 --> 17:46.240]  And then we hope somehow that that won't be exploited by bad guys, whether those bad guys are officials or people who can successfully impersonate officials to the device.
[17:46.740 --> 18:13.820]  Or in the world of privacy denial, we encourage people and we fund them to found businesses predicated on the idea that if you just siphon off ever larger caches of people's personal information as they move through time and space and the Internet, that you can bet somehow you'll be able to monetize that in larger and larger sums before that information leaks and destroys the lives of those people
[18:13.820 --> 18:19.460]  and that you can flip your company before those people realize what you've done and sue you for everything you have.
[18:19.820 --> 18:23.420]  And the problem with this is the old lady who swallowed the fly problem.
[18:23.680 --> 18:28.200]  That these non-solutions beget further non-solutions.
[18:28.340 --> 18:29.660]  The problem is still there.
[18:29.660 --> 18:32.320]  And your non-solution hasn't worked.
[18:32.600 --> 18:37.080]  And we can't admit that the solution hasn't worked because we're wrong.
[18:37.340 --> 18:39.780]  We say the problem hasn't worked because we haven't tried hard enough.
[18:39.980 --> 18:41.720]  Your light cigarettes aren't light enough.
[18:42.820 --> 18:48.960]  The reason your DRM is breaking is because we haven't made it enough of a felony to tell people about the problems with it.
[18:50.000 --> 18:55.600]  The reason that we have privacy problems is that our terms of service aren't thoroughgoing enough.
[18:55.740 --> 19:03.000]  If only we make people admit when they use the service that there are no privacy problems, then there will be no privacy problems.
[19:03.100 --> 19:11.660]  By using this service you agree that I'm allowed to come over to your house and punch your grandmother and wear your underwear and make long distance calls and eat all the food in your fridge, right?
[19:11.820 --> 19:19.500]  Like if you make people agree to that then the privacy problems will somehow go away because they will have agreed that there are no privacy problems.
[19:20.320 --> 19:29.140]  And so we spend more money, we take more elaborate steps, we subject people to more rigmarole to non-solve the real problem.
[19:29.940 --> 19:32.420]  And it starts to feel like too much trouble.
[19:32.680 --> 19:34.620]  It starts to feel like it's a fact of life.
[19:34.860 --> 19:38.980]  I mean, these cigarettes are gonna kill me someday, but what the hell, it's too late to quit now.
[19:39.400 --> 19:45.800]  Or, there's already so much carbon in the atmosphere, there's no point in not enjoying ourselves with the few years we have left.
[19:45.800 --> 20:00.460]  Or, the entertainment industry is gonna insist that DRM be baked into all of our technology, and we won't have a future without their content, so why not just go along with it, and maybe we can convince them not to make it as terrible as they did the last time around.
[20:00.600 --> 20:08.480]  Or, my data is gonna leak no matter what, so I might as well hang out on Facebook and get invited to a few parties before the information apocalypse hits.
[20:08.760 --> 20:09.180]  Right?
[20:09.760 --> 20:12.880]  So this creates nihilism, the idea that there's no future.
[20:12.880 --> 20:16.820]  But eventually, it becomes undeniable.
[20:17.180 --> 20:24.940]  Eventually, at a certain point, no matter how much denial and FUD there is, the problem becomes obvious to everyone.
[20:25.260 --> 20:27.940]  So, like privacy, we're reaching that moment.
[20:28.160 --> 20:33.320]  The U.S. government treats the Computer Fraud and Abuse Act as though violating terms of service was a felony.
[20:33.320 --> 20:43.100]  And so privacy researchers have their hands tied when they discover flaws in systems that we rely on, that we give our data to, and they're not allowed to report it.
[20:43.180 --> 20:48.680]  And we can see the impact of that unfolding every day, and fewer and fewer people don't know about that.
[20:48.840 --> 20:50.420]  More and more people know about it every day.
[20:50.420 --> 21:05.260]  Or the Digital Millennium Copyright Act, which subjects people under Section 1201 to criminal liability for investigating systems with DRM, in order to determine what impact they have, and how much information they're gathering, and how that information is being used.
[21:05.780 --> 21:15.840]  And, you know, so long as we make it a crime to break DRM, so long as we make it a crime to tell people about the flaws in it, we make DRM into an attractive nuisance that spreads and spreads.
[21:16.120 --> 21:27.760]  Section 1201 of the DMCA doesn't stop people from breaking DRM, but it does give manufacturers the legal right to sue people who break DRM, even for legal reasons.
[21:28.100 --> 21:35.860]  So, you know, Philips put DRM in their light sockets and updated their firmware so it would only accept Philips light bulbs.
[21:36.100 --> 21:45.140]  And reconfiguring your light socket becomes a potential felony, even though switching light bulbs is not piracy and isn't against the law.
[21:45.420 --> 21:49.840]  What company would not take up the U.S. government on a sweet offer like that?
[21:49.980 --> 21:58.440]  Add a thin skin of DRM to any product and we will give you the legal tool to sue anyone who removes it, even to do legal things.
[21:58.940 --> 22:01.040]  And so DRM metastasizes, right?
[22:01.160 --> 22:03.180]  DRM is now in every kind of device.
[22:03.360 --> 22:10.560]  Last year, the U.S. Copyright Office held hearings on the problems with the DMCA and with Section 1201 and with DRM.
[22:10.700 --> 22:30.120]  And they heard from researchers who were finding DRM and being frustrated in their ability to report on its flaws in tools as varied as pacemakers, thermostats, cars, medical diagnostic equipment, baby monitors, insulin pumps, cat litter boxes, smart light bulbs,
[22:30.320 --> 22:34.160]  and these little beauties that debuted at CES this year.
[22:34.280 --> 22:36.300]  That's the Internet of Things rectal thermometer.
[22:37.840 --> 22:41.980]  In 2016, we have DRM up the ass.
[22:50.770 --> 23:05.650]  So the privacy and security implications of these things being off limits for auditing and not able to be audited as a consequence, and proliferating without auditing and investigation.
[23:06.290 --> 23:12.410]  Those privacy consequences are figuratively thermonuclear, but they are literally potentially lethal.
[23:13.290 --> 23:18.690]  Because you put computers in your body all day long, and there's only more of them coming, right?
[23:18.750 --> 23:26.910]  Like you and me and everyone we know who grew up with earbuds, we've logged enough punishing audio hours that there will come a day that we're going to have hearing aids.
[23:27.050 --> 23:32.010]  And those hearing aids aren't going to be beige retro hipster analog transistorized hearing aids.
[23:32.010 --> 23:35.370]  Those are going to be like Turing Complete computers in your head.
[23:35.650 --> 23:39.830]  And depending on how they're configured, they will allow you to hear everything.
[23:40.050 --> 23:51.650]  They may give you superhuman hearing, or they may stop you from hearing things selectively, or on a blanket basis, or they may tell other people what you're hearing, or they may make you hear things that aren't there.
[23:51.770 --> 23:55.450]  And it all comes down to whether or not you have the right to investigate them.
[23:55.650 --> 24:00.030]  And having investigated them and discovered flaws in them, you have the right to remediate them.
[24:00.650 --> 24:15.910]  Now, at a certain point, as all of this stuff becomes more and more apparent, as the DRM spreads from one realm into another, as problems with reporting privacy issues, thanks to the Computer Fraud and Abuse Act, become more pointed, we'll hit peak indifference.
[24:16.450 --> 24:22.070]  The moment when the number of people who care about this stuff can only increase, right?
[24:22.350 --> 24:24.150]  There was a moment like that with tobacco.
[24:24.150 --> 24:31.070]  There was a moment in which the number of people who'd watched a loved one die of lung cancer was only going to go up.
[24:31.390 --> 24:38.730]  There was a moment... there will come a moment when climate refugees can no longer be ignored because they will literally be washing up on your shore.
[24:39.390 --> 24:49.490]  There will be a moment, and I think we're at the threshold of that moment, when privacy breaches will, every week, destroy the lives of millions of people.
[24:50.270 --> 24:53.390]  So, you remember the Office of Personnel Management breach?
[24:53.710 --> 24:58.670]  They were collecting information for Americans who wanted security clearance to work with the government and military.
[24:58.990 --> 25:03.510]  To get security clearance, you have to tell the government all the things that might be used to blackmail you.
[25:03.710 --> 25:05.190]  My mom attempted suicide.
[25:05.510 --> 25:06.550]  My brother's in the closet.
[25:06.830 --> 25:08.790]  I have HIV and I haven't told my family.
[25:09.550 --> 25:14.670]  All of that information was stored by the Office of Personnel Management and over 20 million Americans, and it was breached.
[25:14.670 --> 25:18.190]  And the best guess is that it was breached to the Chinese government.
[25:18.530 --> 25:25.710]  And so, there are a lot of people who today feel like they're terminally compromised by the consequences of privacy.
[25:25.930 --> 25:28.070]  And you can see peak indifference at work.
[25:28.530 --> 25:40.410]  This year, I went to a Rand Corporation multi-stakeholder war game where they brought in civil liberties advocates and lawyers and spooks and security experts and CISOs and lots of other people.
[25:40.410 --> 25:49.490]  And they gamed out different scenarios where, you know, all the banking collapses because of a zero-day or all of our network infrastructure dies.
[25:49.690 --> 25:50.230]  What do we do?
[25:50.470 --> 25:56.710]  And they, you know, they put you in a little team, a multidisciplinary team, and they ask you to game out possible answers.
[25:56.850 --> 25:59.750]  And then periodically, someone will come in and say, well, there's riots in Philadelphia.
[25:59.750 --> 26:01.010]  What are you going to tell the president?
[26:01.890 --> 26:05.670]  And under that hothouse condition, people suggest a lot of different possibilities.
[26:05.670 --> 26:09.170]  And a lot of them had real negative privacy implications.
[26:09.510 --> 26:10.770]  And I noticed something.
[26:11.050 --> 26:18.730]  That whenever the really bad privacy stuff came up, all the spooks and three-letter agency and cop types in the room said, no, no, we can't do that.
[26:19.330 --> 26:23.050]  And I couldn't figure it out until one of them mentioned Office of Personnel Management.
[26:23.410 --> 26:25.110]  I was like, oh, yeah, right.
[26:25.350 --> 26:27.670]  Like, a liberal is a conservative who's been mugged.
[26:27.710 --> 26:33.790]  A privacy advocate is a spook who had their personal information raided by the Chinese government from the Office of Personnel Management.
[26:39.540 --> 26:42.100]  And, you know, it's not just spooks, obviously.
[26:42.260 --> 26:46.140]  There are people who've had their information breached in lots of compromising ways.
[26:46.700 --> 27:01.700]  Not just the Ashley Madison breach, but, you know, increasingly we're hearing from people who've been victimized by voyeurs who spy on them through their own security cameras, through their phones' cameras, through their web cameras, and extort them into performing live sex acts on camera,
[27:01.880 --> 27:03.000]  sometimes minors.
[27:03.000 --> 27:11.280]  People whose attackers piece together enough information from lots of disparate breaches, and then use that to come up with novel attacks.
[27:11.440 --> 27:19.400]  It turns out that, like the environmental movement, scammers use every piece to never recycle something that can be reused.
[27:19.400 --> 27:25.060]  So, we have information from old breaches like Target being merged with information from new breaches.
[27:25.280 --> 27:40.520]  And last Christmas, there were a rash of stories in the Wall Street Journal and the Financial Times about homes in New York and London that were being sold out from under their owners by scammers who had pieced together enough information from different breaches to get duplicate deeds for their homes,
[27:40.520 --> 27:43.300]  and who sold their houses out from under them.
[27:43.820 --> 27:53.280]  So, over time, people are coming to realize that just clicking through an agreement doesn't make the privacy issue go away.
[27:53.540 --> 28:06.580]  And over time, people are coming to realize that having computers that are designed to treat you as an attacker, and to prevent you from reconfiguring them so that the manufacturer can make as much money as possible from you, is a colossal disaster.
[28:06.940 --> 28:17.440]  That making it a felony to reconfigure your device to serve its owner rather than its original manufacturer is a real significant problem.
[28:17.720 --> 28:20.640]  And new and new constituencies are coming into the tent every day.
[28:20.960 --> 28:25.720]  So, John Deere was one of the targets of that copyright office hearing last summer.
[28:25.980 --> 28:29.180]  John Deere tractors are computers that you put in fields.
[28:30.260 --> 28:40.900]  And John Deere tractors, when you drive them around your back 40, they gather extremely detailed soil density data, because they have torque sensors on the wheels, and they have centimeter accurate location sensors.
[28:41.220 --> 28:50.080]  And so, by the time you finish plowing your field, you have extremely detailed soil density data that you can use to automate your seed broadcasting.
[28:50.840 --> 28:54.620]  And John Deere locks up this data in their tractors with DRM.
[28:54.760 --> 29:04.860]  And that DRM prevents you from getting diagnostic information out of the tractor so that you can fix it yourself or take it to an independent mechanic who might use third-party parts instead of the very expensive John Deere parts.
[29:05.000 --> 29:10.120]  But it also stops you from getting your seed data out of... your soil data out of your own tractor.
[29:10.440 --> 29:19.660]  And the way that you get that data is you buy it back through John Deere's partners, seed partners like Monsanto, who sell it to you in a package, right?
[29:19.660 --> 29:26.340]  And so, now we have magazines like Modern Farmer taking up the cause of breaking DRM.
[29:26.720 --> 29:30.260]  So, if that's not peak indifference, I don't know what it is.
[29:31.160 --> 29:36.120]  Peak indifference is the moment at which nihilism can and must be averted.
[29:36.500 --> 29:47.160]  The moment in which our job as people who care about this stuff moves from convincing people that this is a problem to convincing something that they can do something about it.
[29:47.680 --> 29:54.120]  That they can quit smoking, call for emissions reduction, install crypto software, jailbreak their devices.
[29:54.520 --> 30:01.280]  It's the moment in which you tell them the names of the people who personally benefited from their immiseration.
[30:01.520 --> 30:06.800]  That you tell them that it wasn't an emergent property of the system that caused them to be where they are.
[30:06.800 --> 30:19.840]  But the depraved indifference of named individuals who chose to put them in that situation by deliberately engineering the false controversy about the thing that the experts knew was true all along.
[30:20.060 --> 30:30.560]  And when that expensively sown doubt finally collapses, that is a moment where, if you can catch it, you can move people from indifference to making a difference.
[30:30.960 --> 30:34.800]  So, for example, I'm on the board of a charity called Simply Secure.
[30:34.800 --> 30:48.140]  Simply Secure creates usable interfaces to crypto for normal people and publishes them under free and open licenses along with fully documented process materials that are also free and open.
[30:48.760 --> 31:08.760]  And Simply Secure's premise is that the reason that privacy tools are hard is not entirely because security is hard, although that's a piece of it, but also because before peak indifference, all the people who knew enough about technology to understand that they should be taking steps to protect themselves was someone who was already a deep geek.
[31:09.080 --> 31:14.300]  Because to understand how all this data could be pieced together required real technical nous.
[31:15.080 --> 31:25.480]  And when all of your audience for a tool are people who are already technologically adept, you might as well assume technological expertise when you develop that tool.
[31:25.480 --> 31:33.740]  But, you know, back when desktop publishing was a new thing, all of the typesetting software on the market assumed that you were already a typographer.
[31:34.120 --> 31:36.360]  And being a typographer is a hard job.
[31:36.540 --> 31:38.820]  People trained for years to be typographers.
[31:39.100 --> 31:50.100]  But it turned out that when we assumed that normal people might want to set type, we could collapse about 95% about what was hard about being a typographer into something that a civilian could use.
[31:50.100 --> 31:56.560]  There's still an irreducible 5% in typography, just like there will always be an irreducible 5% in security.
[31:56.580 --> 32:02.540]  If you're Ed Snowden, you're not going to be able to use an off-the-shelf tool with its default configuration and be private.
[32:02.820 --> 32:08.400]  But there will be something that will help all of us be private even if we don't have technical skills.
[32:08.500 --> 32:10.240]  And that's what Simply Secure's mission is.
[32:10.380 --> 32:14.580]  And we describe it as making tools that are so easy your boss can use them.
[32:16.640 --> 32:22.660]  Because this idea that tools should be so easy your mom can use them in addition to being sexist is horribly inaccurate.
[32:23.340 --> 32:26.280]  Because nobody designs tools for moms, right?
[32:26.400 --> 32:32.880]  We assume that moms will contort themselves to fit whatever dumb assumptions we've made about how they want to use tools.
[32:33.080 --> 32:36.220]  And so moms have to be ninjas to make their technology work.
[32:36.380 --> 32:41.680]  But bosses, bosses get to call up their CIO and say, I don't care about this security business.
[32:41.680 --> 32:49.260]  I'm at a Days Inn in Tampa, and as soon as this kid has finished playing Angry Birds on the laptop in the lobby, I want to sit down and access my email.
[32:49.440 --> 32:50.640]  And you make it work, dammit!
[32:50.900 --> 32:51.140]  Right?
[32:51.320 --> 32:58.480]  So we need to make tools that are so easy that entitled jerks who've never had to take a step to accommodate themselves to technology can use them.
[32:58.580 --> 33:00.200]  And then the rest of us will get to benefit.
[33:11.610 --> 33:11.970]  So...
[33:13.350 --> 33:14.410]  I'm not a ventriloquist.
[33:14.450 --> 33:15.550]  I can't talk while I'm drinking water.
[33:15.550 --> 33:16.130]  So...
[33:17.030 --> 33:23.410]  How do we know how to break the rules, which rules to break, and what to do once peak indifference hit?
[33:23.570 --> 33:24.710]  We need to have principles.
[33:25.290 --> 33:32.150]  As the eminent cryptographer Alexander Hamilton once said, If you stand for nothing, what will you fall for?
[33:33.050 --> 33:37.550]  So just because some rules are bad, it doesn't follow that rules themselves are bad.
[33:37.870 --> 33:40.270]  You need to have principles to guide your work.
[33:40.270 --> 33:45.530]  You need to have a way to defend those principles against people who want you to compromise them.
[33:45.790 --> 33:51.350]  And one of the people who will want you to compromise your principles almost certainly is you in the future.
[33:52.030 --> 33:57.310]  Because there will come a time at which you will feel hopeless or you will feel tired.
[33:57.390 --> 34:02.030]  And all of those calls from outside will ask you to change your principles.
[34:02.810 --> 34:13.970]  And in addition to needing a way to defend your principles, you need a way to amend them to keep them up to date and make sure that they reflect our current reality as technology changes.
[34:14.270 --> 34:16.770]  And we have a really good example of this from our community.
[34:16.770 --> 34:19.530]  The GNU project, the free software project.
[34:19.790 --> 34:23.070]  So the free software movement has an overarching purpose.
[34:23.210 --> 34:29.350]  To make computers serve people rather than making computers into tools to enslave people.
[34:29.590 --> 34:33.550]  And it has three principles that it uses to embody that.
[34:33.670 --> 34:37.310]  The three rules of free software, which is actually four because they number from zero.
[34:38.990 --> 34:41.210]  The right to run code, zero.
[34:41.210 --> 34:43.270]  The right to understand your code.
[34:43.490 --> 34:45.170]  The right to modify your code.
[34:45.530 --> 34:47.530]  And the right to distribute your modifications.
[34:48.150 --> 34:51.030]  And then they have a tool to make those principles stick.
[34:51.230 --> 34:51.990]  The GPL.
[34:52.730 --> 34:56.230]  Once you license software under GPL, there's no backsies.
[34:56.470 --> 34:58.390]  You can't change your mind about it.
[34:58.490 --> 35:00.090]  It's irrevocably licensed.
[35:00.370 --> 35:07.570]  Which means that you might start a business full of high-minded ideas about making the world better in the long term.
[35:07.570 --> 35:11.750]  And you can maintain those high-minded ideals even later.
[35:12.010 --> 35:15.590]  When your investors start putting pressure on you to close off your source code.
[35:15.990 --> 35:19.490]  You literally cannot comply with a request to do that.
[35:19.710 --> 35:21.550]  Not even with a gun to your company's head.
[35:21.770 --> 35:27.210]  Not even to make payroll for 30 dear friends who quit their jobs on your ask.
[35:27.530 --> 35:30.570]  And who are betting their mortgages and their kids' future on you.
[35:30.910 --> 35:37.170]  The idealistic you, who was present at the start, has defended future you from your own weakness.
[35:37.170 --> 35:46.110]  And what's even better than that is once your investors understand that you can't change your mind, they won't pressure you.
[35:46.230 --> 35:46.510]  Right?
[35:46.670 --> 35:52.270]  There's no point in asking people to change things that they are literally incapable of changing.
[35:52.270 --> 35:53.510]  It's a waste of time.
[35:53.670 --> 35:56.330]  They can't fire you and hire someone more pliable.
[35:56.550 --> 36:01.270]  There's no course of action that puts the GPL toothpaste back in the tube.
[36:01.270 --> 36:04.710]  Now this has got a technical name in economic circles.
[36:04.850 --> 36:06.130]  It's called the Ulysses Pact.
[36:06.670 --> 36:13.450]  When Ulysses was sailing into siren infested waters, the accepted security protocol was to fill your ears with wax.
[36:13.610 --> 36:17.910]  So you couldn't hear the siren songs that would lure you into jumping into the sea and drowning.
[36:18.170 --> 36:19.890]  But Ulysses was a hacker.
[36:20.270 --> 36:22.110]  He wanted to explore forbidden territory.
[36:22.110 --> 36:25.530]  So he wanted to hear the siren songs, but he wanted to remain safe.
[36:25.530 --> 36:37.370]  So he said to his sailors, lash me to the mast so that once we sail into the waters, no matter how badly I want to jump into the water and drown, thanks to the siren songs, I can't.
[36:37.750 --> 36:42.750]  Future Ulysses was defended by early Ulysses from his own moment of weakness.
[36:43.130 --> 36:48.750]  You license code under the GPL for the same reason you throw away the Oreos the night you start your diet.
[36:50.630 --> 36:54.730]  Not because you're not strong enough to resist Oreos.
[36:54.950 --> 37:02.730]  But because being that strong involves being realistic and recognizing that there will be a future you with a weak moment.
[37:02.890 --> 37:04.490]  With a moment of low blood sugar.
[37:04.930 --> 37:12.530]  And using the strength of that moment to armor yourself against the coming weakness that all of us experience from time to time.
[37:12.530 --> 37:17.710]  And the GPL is especially resilient to attacks on it.
[37:17.830 --> 37:23.910]  Because the most obvious way to weaken the GPL is to say, well, software isn't copyrightable and therefore licenses are invalid.
[37:24.090 --> 37:26.470]  Which is exactly their victory condition.
[37:26.770 --> 37:28.690]  So heads I win, tail you lose.
[37:29.690 --> 37:39.910]  Now, the early pioneers of the net set out to build a decentralized open system to let anyone talk to anyone else without anyone being able to stop them.
[37:39.910 --> 37:46.150]  But along the way, we accidentally built the world's biggest surveillance system.
[37:46.690 --> 37:59.450]  A surveillance system that's so advanced that now, when there's a coup or an uprising, the chances are pretty good that rather than shut the Internet off to stop the coup, the powers that be will leave it on to spy on it.
[38:00.090 --> 38:02.650]  Now, no one is the villain of their own story.
[38:02.650 --> 38:15.650]  The net's pioneers went from don't be evil to surveillance capitalism, not by twirling their mustache and deciding to sell out, but by taking one tiny compromise, one step at a time.
[38:16.150 --> 38:18.630]  Each one only a little distance from the last one.
[38:18.830 --> 38:24.670]  Because as humans, we cognitively really only sense relative differences, not absolute ones.
[38:24.670 --> 38:30.810]  You know that exercise where you have a black stripe and a... or a grey stripe in between a black stripe and a white stripe.
[38:30.930 --> 38:34.270]  And if you cover the black stripe, the grey stripe looks lighter.
[38:34.470 --> 38:36.470]  And if you cover the white stripe, it looks darker.
[38:36.470 --> 38:40.030]  Because we really only sense the relative differences between things.
[38:40.150 --> 38:49.250]  And so when you make a little compromise, you evaluate the next compromise you're asked to make, not against the position you were in when you started, but against the position that you've come to.
[38:49.250 --> 38:56.310]  And any compromise can be arrived at in a series of sufficiently small steps that each one seems harmless.
[38:57.170 --> 39:04.570]  So there is this great project underway to reverse that, to harden the Internet against surveillance, to re-decentralize it.
[39:04.670 --> 39:19.690]  And if we're going to prevent the network that we're building through the re-decentralization project to de-re-decentralize, then we need rules and tools to guard us from our future selves and our moments of weakness.
[39:20.090 --> 39:26.070]  The rules that will defend us now when we're pirates from the admirals that some of us will inevitably become.
[39:26.930 --> 39:30.870]  So, on those lines, I'm going to propose two rules today.
[39:31.050 --> 39:38.390]  Two ironclad principles that we can evaluate any potential solution to any problem that we have in the future against.
[39:38.390 --> 39:40.830]  Rules that will make us fail gracefully.
[39:40.830 --> 39:45.610]  The first one is that computers should be designed to obey their owners.
[39:46.070 --> 39:54.590]  When a computer receives two conflicting instructions, one from its owner and one from a remote party, the owner should always win.
[39:55.810 --> 40:03.230]  The second principle is that true facts about computer security should always be legal to disclose.
[40:03.230 --> 40:05.790]  When people rely... Thank you.
[40:11.310 --> 40:24.490]  When people rely on a computer and you know that it isn't suitable for them to rely on it, there should never be a legal barrier to you telling those people that they can't trust the computer, that they're relying on them.
[40:25.430 --> 40:36.550]  And the way that we're going to make those stick, the way that we will armor ourselves against future moments of weakness, is by building them in to the legal code and the moral code of our network.
[40:36.710 --> 40:39.590]  By making them our principles and by making them our rules.
[40:39.930 --> 40:41.450]  We'll make them license terms.
[40:41.630 --> 40:44.950]  We'll make them conditions of membership and consortiums and standards bodies.
[40:45.250 --> 40:47.690]  We'll make them conditions of regulatory approval.
[40:47.690 --> 41:06.490]  At EFF, we've just asked the FDA to tell medical device manufacturers, implant manufacturers, that as a condition of having their devices certified to be put in people's bodies, they have to promise never to invoke Section 1201 of the DMCA against security researchers who know true facts about the flaws in those devices.
[41:07.490 --> 41:08.270]  Thank you.
[41:11.940 --> 41:26.440]  We've asked the FCC to make that a condition of their new set-top box rules, so that as 80 million households transition from having those terrible cable boxes in their living rooms to having new independently certified boxes in their living rooms that can be made according to open standards,
[41:26.670 --> 41:42.500]  that the definition of open standard include that to comply with the standard, you have to make a legally binding promise never to attack people who know about flaws in those devices that are camera equipped, microphone equipped, that sit at the boundaries of our networks and that live in our living rooms.
[41:43.170 --> 41:48.250]  We should ask the Department of Transport to make that a condition of certifying firmware for cars.
[41:49.130 --> 42:00.040]  Every regulatory forum should have as a rule that you can never, as a condition of being approved for regulation, you can never threaten people who know true facts about the dumb mistakes you've made.
[42:01.190 --> 42:04.130]  We can incorporate these into the definition of open standards.
[42:04.400 --> 42:26.070]  And the Open-Source Initiative, which is one of the great keepers of definitions, have in fact amended their definition of open standard to say that when you certify something through which the DMCA or laws like it can be invoked, it is not an open standard unless you also make everyone who implements that standard make a legally binding promise not to attack people who implement new features for
[42:26.070 --> 42:29.840]  it or people who discover and report flaws in it.
[42:30.590 --> 42:33.770]  Now, there's places where this is a live issue today.
[42:34.250 --> 42:47.570]  The World Wide Web Consortium is the very long-running and correctly respected organization that has been one of the forerunners of open standardization on the web and one of the great flag barriers for it.
[42:47.710 --> 42:49.270]  But they've made a dumb mistake.
[42:49.270 --> 43:11.630]  They've allowed the Hollywood Studios and the major browser vendors to corner them into incorporating DRM into the core standards for HTML5, which is envisioned as a mechanism for replacing apps as the control interfaces for actuating and sensing tools as varied as airplanes and nuclear reactors to pacemakers and your home thermostat.
[43:12.110 --> 43:26.360]  And by incorporating DRM into that standard, they are potentially making them off-limits to external auditing, disclosure, and the addition of new features that unlock functionality that has been irrigated to the manufacturer at the expense of the user.
[43:26.900 --> 43:29.190]  We tried to get them not to do this at EFF.
[43:29.420 --> 43:33.810]  We joined the W3C and made a principled argument for them not to do it, and it fell on deaf ears.
[43:34.070 --> 43:42.480]  But we've since made another argument, which is that the W3C already has policies about other kinds of government-imposed monopolies.
[43:42.580 --> 43:49.960]  They have a patent policy that says that if you join the W3C, you have to promise never to use your patents to attack people who implemented standards.
[43:50.480 --> 43:58.750]  We've asked them to extend that policy to say that if you join the W3C to make DRM, you must promise never to use the rights that you get under statutes like the DMCA.
[43:59.060 --> 44:11.230]  And the DMCA has international equivalents all over the world because the U.S. Trade Representative is patient zero in an epidemic of shitty Internet law that has been spread to every country that the Internet... that America trades with.
[44:13.270 --> 44:26.250]  So we've asked them to adopt this as a rule that if the W3C makes a standard that gives you the right to sue people under one of those laws, they have to make you promise not to use it as a condition of participating in that standard.
[44:26.540 --> 44:29.290]  We tried to get it through in the last round of voting on this.
[44:29.380 --> 44:30.040]  We didn't get it through.
[44:30.120 --> 44:33.340]  Now we have a much larger constituency who have supported this.
[44:33.770 --> 44:53.400]  Organizations as diverse as Oxford University and the Royal National Institute for the Blind, who are correctly worried that if you make it a felony to add functionality to tools within the manufacturer's consent, that you will wall off people who want to add and extend functionality to allow for accessibility.
[44:53.940 --> 44:57.080]  And there are ways that I want you folks to help in this.
[44:57.180 --> 44:59.140]  This is a campaign that's live underway right now.
[44:59.230 --> 45:00.580]  It's occupying the majority of my time.
[45:00.730 --> 45:03.420]  And you can help in meaningful ways, in two ways.
[45:03.420 --> 45:10.290]  The first is, if you are a security researcher, please sign on to our petition, asking the W3C to take this step.
[45:10.460 --> 45:11.540]  Ron Rivest has signed.
[45:11.710 --> 45:13.120]  The CORTOR team has signed.
[45:13.200 --> 45:14.440]  Bruce Schneier has signed.
[45:14.600 --> 45:15.540]  I want you to sign.
[45:15.640 --> 45:18.060]  And the way that you sign that petition is you send me an email.
[45:18.600 --> 45:20.600]  Cory at EFF.org.
[45:21.290 --> 45:23.080]  C-O-R-Y at EFF.org.
[45:23.180 --> 45:23.810]  Tell me your name.
[45:24.230 --> 45:29.880]  Tell me what country you're in, because we want them to know how many different territories support this, because it's the World Wide Web.
[45:29.880 --> 45:34.600]  And tell me if you have an institutional affiliation, like a company or university that can accompany your name.
[45:34.710 --> 45:36.480]  And we will add you to that petition.
[45:36.700 --> 45:38.290]  And that petition, you should go look at it.
[45:38.380 --> 45:39.840]  It's long and awesome.
[45:40.040 --> 45:58.290]  It's full of some of my personal security heroes, all of whom have come together to tell the W3C that it is terrible, a terrible mistake and terrible for the future of the web, to introduce a weapon that allows companies to punish security researchers who discover embarrassing mistakes that they've made.
[45:58.980 --> 46:02.250]  The other way that you can help is by auditing these implementations.
[46:02.460 --> 46:06.140]  So there are... the standard is called EME encrypted media extensions.
[46:06.620 --> 46:08.680]  There are EME implementations already in the wild.
[46:08.770 --> 46:10.290]  The major browser vendors all have them.
[46:10.480 --> 46:14.160]  There's a Microsoft one, a Google one, an Apple one, and a Mozilla one.
[46:14.880 --> 46:18.080]  The Google one was just audited by an Israeli researcher.
[46:18.270 --> 46:22.710]  Israel is one of the only industrialized nations that doesn't have an analog to DMCA 1201.
[46:22.710 --> 46:28.900]  And this researcher discovered that it had showstopper bugs that he thinks might have existed since 2010.
[46:29.400 --> 46:29.880]  Right?
[46:30.080 --> 46:35.770]  And as we know, requiring people not to disclose bugs doesn't mean that they don't get independently discovered.
[46:35.880 --> 46:39.660]  It just means that the last people to find out about them are the people who rely on them.
[46:39.660 --> 46:45.270]  So if you're looking for something to audit, we want you to take a good hard look at these tools.
[46:45.560 --> 46:50.270]  And then contact us if you find something that you worry will impose liability about disclosing it.
[46:50.460 --> 46:53.040]  Info at EFF.org is our intake address.
[46:53.230 --> 46:55.840]  And we want to hear from you if you find something in these.
[46:55.940 --> 47:05.730]  Because we want to be able to make the case to the W3C that they're living in a fool's paradise if they think that they can be secure by passing rules against auditing their own implementations.
[47:08.820 --> 47:13.380]  So we need... your rule breaking needs principles like these two principles.
[47:13.580 --> 47:15.080]  That computers should obey their owners.
[47:15.080 --> 47:18.710]  And that true facts about security should always be lawful to disclose.
[47:19.160 --> 47:21.640]  We need these simple minimum viable agreements.
[47:21.810 --> 47:23.420]  These rules for rule breaking.
[47:23.580 --> 47:27.640]  Principles that you can be so hardline on that they call you an extremist.
[47:27.640 --> 47:34.810]  If someone's not calling you an unrealistic utopian puritan about these rules, you're not trying hard enough.
[47:38.540 --> 47:40.000]  And you need tools.
[47:40.000 --> 47:41.880]  You need your own Ulysses pacts.
[47:42.000 --> 47:46.200]  You need ways to defend yourself against future compromised you.
[47:46.580 --> 47:50.840]  The werewolf's sin isn't that he turns into a werewolf on the full moon.
[47:50.900 --> 47:54.340]  It's that he doesn't lock himself away before the moon rises.
[47:54.700 --> 47:56.840]  Your trick is not to stay pure.
[47:57.060 --> 47:58.600]  You will never stay pure.
[47:58.600 --> 47:59.500]  We all make slips.
[47:59.640 --> 48:01.560]  Every vegetarian meets a vegan someday.
[48:01.880 --> 48:03.640]  Every vegan meets a fruitarian.
[48:03.840 --> 48:05.780]  Every fruitarian meets a breatharian.
[48:06.000 --> 48:11.640]  Your trick is to anticipate and correct for the impurities that are sure to come.
[48:11.960 --> 48:15.740]  And once you have these principles, they can inform everything that you do.
[48:17.420 --> 48:18.160]  Hang on.
[48:18.240 --> 48:19.800]  Let me see if I can make this scroll.
[48:23.640 --> 48:25.260]  No, I guess not.
[48:26.260 --> 48:27.900]  I'm going to shut down the slides for now.
[48:29.680 --> 48:31.380]  So, I have an announcement to make.
[48:31.540 --> 48:32.200]  You may have seen it.
[48:32.360 --> 48:36.940]  On Thursday, the Electronic Frontier Foundation announced that we are suing the U.S. government over Section 1201 of the DMCA to invalidate it.
[48:49.100 --> 48:52.160]  Now, DMCA 1201, that's what I've been talking about during this talk.
[48:52.160 --> 48:59.680]  It's the rule that says that breaking DRM, even for lawful purposes, even for legitimate purposes, can be a crime.
[48:59.860 --> 49:04.520]  That disclosing true facts about defects in DRM can be a crime.
[49:04.700 --> 49:13.080]  And we're representing two clients that represent these two facets, the right to reconfigure a device in lawful ways and the right to report true facts about its security.
[49:13.080 --> 49:16.300]  The first one is someone you've probably heard of, a guy named Bunny Wang.
[49:16.580 --> 49:17.620]  Does everyone know Bunnie Wang?
[49:18.020 --> 49:18.380]  Yeah.
[49:18.760 --> 49:21.980]  So, Bunnie broke the Xbox when he was a grad student at MIT.
[49:22.440 --> 49:24.840]  And he went to the general counsel for MIT.
[49:24.880 --> 49:27.140]  And the general counsel said, you're on your own, kid.
[49:27.320 --> 49:31.900]  You decided to poke the Microsoft bear on your own time.
[49:31.900 --> 49:35.040]  And it's not MIT's job to defend you against that.
[49:35.100 --> 49:35.780]  So, he came to us.
[49:35.880 --> 49:37.440]  He came to the Electronic Frontier Foundation.
[49:37.780 --> 49:39.840]  And we made sure that he could publish his work.
[49:39.840 --> 49:42.680]  And he's since gone on to be a hero of reverse engineering.
[49:43.000 --> 49:47.020]  And of product development and of security.
[49:47.600 --> 49:51.120]  Our other client is someone else you've probably heard of.
[49:51.200 --> 49:53.220]  Johns Hopkins researcher named Matthew Green.
[49:53.760 --> 50:02.940]  Matthew Green has an incredible storied history as having worked on some of the most important security accomplishments in our field.
[50:03.140 --> 50:05.620]  Most recently, he was part of the team that audited TrueCrypt.
[50:05.620 --> 50:09.860]  Now, Bunny we're representing because he made a product called AnyTV.
[50:10.800 --> 50:17.520]  AnyTV is a shim that allows you to insert graphics or overlays in an HDCP signal.
[50:17.640 --> 50:19.540]  High definition DRM video signal.
[50:19.720 --> 50:20.700]  And it was really clever.
[50:20.840 --> 50:23.800]  He figured out how to do it without breaking the DRM.
[50:24.000 --> 50:27.780]  And so, there wasn't any legal risk for him doing it.
[50:27.880 --> 50:29.220]  But he wants to extend AnyTV.
[50:29.220 --> 50:31.000]  He wants to make something called NetVCR.
[50:31.160 --> 50:32.200]  AnyTV VCR.
[50:32.740 --> 50:38.460]  That will allow you to make fair uses of high definition video by allowing you to capture it and save it in the clear.
[50:39.340 --> 50:47.080]  And Matthew Green, we're representing him because he has certain research projects that he'd like to undertake that he believes the DMCA threatens.
[50:47.320 --> 50:56.940]  He wants to investigate the security of industrial grade encryption devices used to secure cryptographic keys for purposes like protecting credit card and ATM transactions.
[50:56.940 --> 51:02.080]  And he has a grant from the National Science Foundation to investigate the security of medical record systems.
[51:02.320 --> 51:14.120]  And he wants to investigate the security of medical devices, toll collection systems, industrial firewall and VPN devices, wireless communication systems, and systems that connect vehicles to one another and their surrounding infrastructure.
[51:14.580 --> 51:25.300]  Now, you can see a kind of a priori that lurking flaws in devices like this are a serious threat to the economy and to the hundreds of millions of people who rely on them every day.
[51:25.300 --> 51:34.980]  So we really want to make sure that Green is able to independently validate their quality because the bad guys who abuse those devices don't ask for permission to investigate their flaws.
[51:35.680 --> 51:38.420]  We need to be able to investigate all the things.
[51:39.100 --> 51:43.620]  Our lawsuit challenges the constitutionality of Section 12 of the DMCA.
[51:44.380 --> 51:51.460]  We argue that restrictions on which code you can write infringe the First Amendment.
[51:51.760 --> 51:56.240]  And that disclosing security vulnerabilities is a constitutionally protected form of speech.
[51:56.480 --> 52:00.660]  And that fair use can only be enabled if you can acquire the tools to make those uses.
[52:01.080 --> 52:04.660]  And a funny thing happened the day we filed that lawsuit.
[52:04.880 --> 52:10.940]  A starter pistol was fired because the status of the law became indeterminate on that day.
[52:10.940 --> 52:19.660]  The world around us is full of computers that have been designed to disobey and control their owners to secure monopoly rents for their manufacturers.
[52:19.980 --> 52:26.700]  To metastasize the inkjet printer business model into devices as varied as tractors and insulin pumps.
[52:27.400 --> 52:31.340]  And risk-takers and entrepreneurs have been slavering to break DRM.
[52:31.340 --> 52:37.440]  If DRM costs a user $10, then a DRM defeat device should be easily vendable for $5.
[52:37.840 --> 52:45.140]  As Jeff Bezos once said in a moment of unusual candor to the publishers, your margin is my opportunity.
[52:46.320 --> 52:58.660]  And even before we won our suit, even as it progresses through the legal system over the next year, two years, maybe even ten years if we get to the Supreme Court, we're changing the risk calculus for entrepreneurs and their backers.
[52:58.660 --> 53:14.300]  Giving people who don't care about this ethical stuff, but who for purely selfish reasons want to break DRM, a good reason, personal reason to take the risk that if they break DRM, their business might end up being lawful when we prevail.
[53:14.600 --> 53:21.220]  And that's the final lesson I want to give you today about designing disobedience to defeat peak indifference.
[53:21.480 --> 53:32.580]  That there are people who will support you on principle and you should welcome them into your fold, but it never hurts to arrange things so that they can support you out of their own self-interests, even if they don't give a damn about the principles.
[53:37.460 --> 53:50.040]  So, at EFF, I, you may know, worked for EFF and then quit my job to write full-time and make up stories to help you pass the long, arduous slog from the cradle to the grave.
[53:51.580 --> 54:02.200]  And a few years ago, I went back to EFF, and I went back to EFF after seeing that the Mozilla project had decided that they needed to make DRM in order to be viable, and after losing that argument with the Mozilla people.
[54:02.440 --> 54:06.620]  And when I saw that and when I heard that, it made me really upset.
[54:07.860 --> 54:23.700]  It kind of combined with being a father of a young child to make me realize that the posterity we were bequeathing to the next generation was not the future I'd hoped for, in which computers say, yes, master, it was the computer, it was the future that we'd always feared,
[54:23.720 --> 54:27.060]  the one where computers say, I can't let you do that, Dave.
[54:29.020 --> 54:34.760]  And so, I went back to Electronic Frontier Foundation to work on a project we call Apollo 1201.
[54:34.940 --> 54:43.980]  Section 1201 of the DMCA is the rule that makes it a crime to defeat DRM, and the Apollo project was a 10-year mission to do something that everyone thought was impossible.
[54:43.980 --> 54:48.240]  Our 10-year mission is to end all the DRM in the world forever.
[54:55.490 --> 55:11.510]  And this lawsuit is the first step, because as the idea that breaking DRM becomes more legitimate in more places, all those countries that have passed laws at the behest of the U.S. Trade Representative will start to question whether or not that was the best idea.
[55:11.670 --> 55:14.930]  After all, suicide packs are supposed to be mutual, right?
[55:14.930 --> 55:31.610]  If the U.S. has said that its industry isn't going to participate in some potentially profitable line on the condition that Hungary or the UK or France or Canada or Australia also makes such a promise, and then the U.S. goes ahead and starts businesses that do that,
[55:31.770 --> 55:33.790]  well, why keep the law on your books?
[55:33.790 --> 55:41.530]  And without the DMCA, without laws that make it a crime to remove DRM for legitimate purposes, who would make it?
[55:41.610 --> 55:46.630]  What's the point of making a thing that hides keys and tools that you give to your adversary?
[55:46.890 --> 55:56.670]  After all, if there's no structural impediments to breaking it, people will just break it for the same reason that if you keep safes in the bank robber's living room, you will wake up and find all your money gone.
[55:56.670 --> 55:58.750]  So, how can you support this?
[55:58.850 --> 56:01.930]  I've talked to you about supporting us in our W3C work.
[56:02.330 --> 56:03.510]  Cory at EFF.org.
[56:03.650 --> 56:04.330]  Tell me your name.
[56:04.550 --> 56:06.010]  Tell me your institutional affiliation.
[56:06.170 --> 56:07.370]  Tell me what country you're in.
[56:07.530 --> 56:08.730]  You can support EFF.
[56:09.190 --> 56:11.930]  Electronic Frontier Foundation is a member-supported nonprofit.
[56:12.950 --> 56:16.570]  I've never seen an organization squeeze a dollar till it hollers more.
[56:16.790 --> 56:20.890]  We are remarkably effective for the small amount of money that we spend.
[56:21.010 --> 56:28.250]  We take on multibillion-dollar adversaries with very, very small money, and we win, and we win, and we win, and you can help us.
[56:28.710 --> 56:36.710]  The ACLU has just launched a lawsuit against the Computer Fraud and Abuse Act to repeal key sections of that or invalidate key sections of that.
[56:36.830 --> 56:39.590]  They have a booth downstairs two doors over from EFFs.
[56:39.690 --> 56:44.010]  If you're not an ACLU member, you should be, especially in this season of voter suppression.
[56:44.210 --> 56:46.470]  It's a key campaign the ACLU is working on.
[56:46.610 --> 56:53.770]  And then if you're associated with a learning institution, a university, a high school, we have a new campus network that we're building out.
[56:53.770 --> 56:56.870]  And my colleague, Shahid Buttar, is running that.
[56:57.030 --> 57:01.310]  And we're going to build out a generation of people who care about this stuff and work on it.
[57:01.450 --> 57:10.450]  And so if you send me an email, Cory at EFF.org, or you can send it to him, Shahid at EFF.org, S-H-A-H-I-D at EFF.org.
[57:10.550 --> 57:12.570]  He can help you set that up on your own campus.
[57:12.570 --> 57:16.630]  And we're going to create a generation of young activists right at the moment that we need it.
[57:17.110 --> 57:18.910]  And so that's my talk.
[57:19.150 --> 57:21.090]  That's the things I want you to know today.
[57:21.370 --> 57:22.890]  That we can make a difference.
[57:23.270 --> 57:30.910]  That, you know, people ask me, they say, you're a science fiction writer, are you hopeful or pessimistic about the future?
[57:30.970 --> 57:32.410]  Are you optimistic or pessimistic?
[57:32.610 --> 57:38.790]  And optimism and pessimism are a kind of prediction about the future, that things will get better or things will get worse.
[57:38.790 --> 57:43.930]  And if there's one thing I know as a science fiction writer, it's that science fiction writers suck at predicting the future, right?
[57:44.450 --> 57:45.690]  And so I don't try.
[57:46.670 --> 57:50.790]  But I don't think it's necessary to have optimism or pessimism to want to do something.
[57:50.910 --> 58:06.330]  After all, if you believed that tomorrow we would figure out all this computer stuff, and we would find a way to make computers our honest servants rather than tools for magnifying inequality and injustice, you should get up every morning and do everything you can to make sure that comes true.
[58:06.770 --> 58:17.490]  And if you think that tomorrow these computers around us will end up enslaving us and being tools of oppression, you should get up every morning and do everything you could to stop that from happening.
[58:18.110 --> 58:22.430]  So rather than being optimistic or pessimistic, excuse me, I ask you instead to have hope.
[58:24.170 --> 58:29.330]  Hope has been tarnished in the last couple of election campaigns, but I think there's still some life in it.
[58:29.550 --> 58:38.370]  Because hope is what you do, as this conference will tell you, hope is what you do when you think that there's something you can do to make the situation better.
[58:38.610 --> 58:40.990]  It doesn't mean that you know how to solve the whole thing.
[58:41.110 --> 58:42.690]  It means that you know what to do next.
[58:42.850 --> 58:46.090]  Hope is why if your ship sinks in the sea you tread water.
[58:46.430 --> 58:55.050]  Not because most of the people who tread water when their ship sank were rescued, but because everyone who was rescued treaded water until rescue arrived.
[58:55.050 --> 59:02.390]  If there is a step that you can take next that will take you to a place where there might be another step, then you have hope and you can do something.
[59:02.650 --> 59:06.690]  And so I'm going to ask you today to pledge yourself to hope, to do something.
[59:07.090 --> 59:10.710]  It's every day you can wake up and say to yourself, I've made some compromise.
[59:10.710 --> 59:11.750]  I am tarnished.
[59:11.950 --> 59:14.950]  I'm not using free and open-source software in everything I use.
[59:15.090 --> 59:20.250]  I'm giving money every month to phone companies whose mission is to destroy the free and open Internet.
[59:20.550 --> 59:25.350]  I'm giving money to ISPs that want to make net neutrality a thing of the past.
[59:25.530 --> 59:32.510]  I buy my crystal prison devices from the Cupertino company that wants to make DRM the alpha and omega of all future computing.
[59:33.070 --> 59:36.350]  And it's true, we all make compromises.
[59:36.530 --> 59:41.110]  But so long as you have hope, you have a way to free yourself from those compromises.
[59:41.270 --> 59:58.350]  And if you find yourself feeling so stained that it's hard to get out of bed, I have a little exercise for you, one that Denise Cooper, who you may know from free and open-source circles, twigged me too, which is that you can add up the amount of money you spend every month on companies that want to destroy the future you want to live in.
[59:58.530 --> 01:00:02.970]  And you can give that much money every month to organizations that are trying to save it.
[01:00:03.050 --> 01:00:07.850]  Not just EFF, not just the ACLU, all the organizations that have cropped up since then.
[01:00:08.850 --> 01:00:10.850]  And so with that, I'll take your questions.
[01:00:11.290 --> 01:00:15.990]  I would like to start with someone who identifies as a woman or non-binary, and then we'll move to men.
[01:00:16.130 --> 01:00:16.930]  Where's the mic at?
[01:00:17.270 --> 01:00:17.610]  Is it?
[01:00:18.350 --> 01:00:19.690]  I can't see anything.
[01:00:20.230 --> 01:00:20.990]  In the center.
[01:00:21.370 --> 01:00:22.070]  In the middle.
[01:00:22.410 --> 01:00:23.250]  So if we could start there.
[01:00:23.370 --> 01:00:26.170]  And again, I remind you, long rambling statements followed by what do you think of that?
[01:00:26.370 --> 01:00:27.210]  Not a good question.
[01:00:29.190 --> 01:00:33.330]  So are there any people who identify as female or non-binary who'd like to start the questioning?
[01:00:38.130 --> 01:00:40.910]  I know it sucks to be put on the spot like this.
[01:00:41.070 --> 01:00:43.910]  The thing is that otherwise it's just a total sausage fest.
[01:00:46.310 --> 01:00:46.970]  It's true.
[01:00:49.330 --> 01:00:49.910]  All right.
[01:00:50.130 --> 01:00:52.790]  Let's start with a dude and we'll move on.
[01:00:53.030 --> 01:00:53.470]  Please.
[01:00:53.690 --> 01:00:54.550]  Oh, wait, wait.
[01:00:54.790 --> 01:00:55.190]  Thank you.
[01:00:55.410 --> 01:00:56.670]  I can't see from up here.
[01:00:56.790 --> 01:00:57.110]  Thank you.
[01:01:00.490 --> 01:01:01.530]  Thank you very much.
[01:01:02.190 --> 01:01:02.790]  Go ahead.
[01:01:03.310 --> 01:01:10.810]  What do you find to be the most effective strategy for people who are non-technical who are swayed by fear arguments made by the opposing side?
[01:01:10.810 --> 01:01:10.810]  Okay.
[01:01:11.450 --> 01:01:15.210]  So when you're talking about vulnerability disclosure or surveillance or...
[01:01:15.210 --> 01:01:15.910]  Particularly encryption.
[01:01:16.230 --> 01:01:16.810]  Encryption.
[01:01:16.990 --> 01:01:19.690]  Oh, so you're talking about crypto backdoors.
[01:01:20.070 --> 01:01:20.090]  Yeah.
[01:01:20.150 --> 01:01:46.590]  So I think that when you... if you can explain to people that we have a new fact in the universe that we've never had before, that we can take these like pocket distraction rectangles and use them to turn clear texts into cipher texts that are so scrambled that if all the hydrogen atoms in the universe were turned into computers and they did nothing but try and brute force the key until the end of
[01:01:46.590 --> 01:01:49.890]  time, we would run out of universe before we ran out of key space.
[01:01:50.310 --> 01:02:00.630]  And then say to them, we know how to make that, but we don't know how to make the one that stops working at the moment we need it to stop and starts working at the next moment.
[01:02:00.870 --> 01:02:04.890]  That you can help them to understand that the backdoor is like a technical non-starter.
[01:02:05.450 --> 01:02:12.550]  And we can say like, look, it would be great if there were... like there are lots of times when it'd be great if we could break crypto for a good reason.
[01:02:12.870 --> 01:02:20.050]  You may have seen at ShmooCon there was a presentation from a cryptographer whose colleague had died in a head-on collision.
[01:02:20.430 --> 01:02:23.170]  And he had not left his keys with anyone.
[01:02:23.330 --> 01:02:29.590]  And so his wife lost all of their photos and the business that he ran had no recoverable keys.
[01:02:29.770 --> 01:02:32.710]  Like it would be great if we could figure out how to do that, but we don't.
[01:02:32.890 --> 01:02:44.590]  And in the absence of that, if we have systems that are broken that we rely on, then it means that things like firmware updates for your pacemaker and your car can't be trusted.
[01:02:44.870 --> 01:02:49.470]  And so the stakes are very high when we... when we compromise our crypto.
[01:02:49.850 --> 01:02:52.290]  And it's hard enough to make this stuff work, right?
[01:02:52.390 --> 01:02:54.670]  Like we can see the disasters unfolding all the time.
[01:02:54.930 --> 01:02:56.170]  So it's hard enough to make this stuff work.
[01:02:56.170 --> 01:02:58.170]  But it is... it's a complicated and nuanced argument.
[01:02:58.330 --> 01:03:01.850]  And of course the other side has a really simple un-nuanced argument.
[01:03:02.070 --> 01:03:08.690]  And that argument is these poindexters know how to do it, but they just love terrorism and hate America, right?
[01:03:08.990 --> 01:03:16.490]  And it's really hard to counter un-nuanced sort of bullshitty arguments with nuanced.
[01:03:16.810 --> 01:03:18.630]  It's a little more complicated than that argument.
[01:03:18.830 --> 01:03:20.290]  But it's the argument we have to make.
[01:03:20.310 --> 01:03:22.010]  And I think we make it one person at a time.
[01:03:22.150 --> 01:03:27.450]  And I think to the extent that peak indifference is the moment that we're at, we will only be benefited by this, right?
[01:03:27.550 --> 01:03:32.470]  Like, so as the years go by, the number of people... the number of things you can point to where crypto failures have done something bad...
[01:03:32.470 --> 01:03:42.590]  Hey, do you remember last year when, like, there was a demonstration in some former Soviet basket case, Republic, and everyone had their identities captured with MC catchers in the square?
[01:03:42.630 --> 01:03:48.090]  And then when they went home, they got a text that said, Dear Citizen, you're recorded as a participant in a legal demonstration.
[01:03:48.090 --> 01:03:52.130]  That's why we turned your heat off in February with your Internet-connected thermostat.
[01:03:52.330 --> 01:03:57.190]  And they were able to do that because there were backdoored lawful interception backdoors and that.
[01:03:57.390 --> 01:03:59.990]  Then I think you can make the point, right?
[01:04:00.470 --> 01:04:07.110]  You can remind people that lawful interception allows the lawful authorities to intercept.
[01:04:07.570 --> 01:04:12.590]  And that right now, in a big piece of the Middle East, the lawful authority is ISIS, right?
[01:04:12.590 --> 01:04:16.630]  And, you know, the software can't tell if the government is ISIS.
[01:04:16.950 --> 01:04:19.430]  The software just knows that it's the government.
[01:04:19.910 --> 01:04:21.410]  So, I guess all of that.
[01:04:21.550 --> 01:04:32.630]  And then the other argument I use sometimes is, especially if people like detective movies, is I say, you ever, like, watch a detective movie where someone gets a license plate number and they're like, how are we going to find out who that license plate belongs to?
[01:04:32.670 --> 01:04:33.410]  Oh, I know a guy.
[01:04:33.550 --> 01:04:35.650]  I'll just go buy him a drink and he'll look it up.
[01:04:35.830 --> 01:04:46.050]  Well, if that's the level of security we have for things that if you're a cop you know the password to, do we want that level of security for your thermostat, your pacemaker?
[01:04:46.290 --> 01:04:50.050]  The camera in your living room that's on when your kids are naked?
[01:04:50.710 --> 01:04:54.770]  You know, all of those things, do we want that to, do we want that level of insecurity?
[01:04:55.990 --> 01:04:57.830]  So, I know it's hard.
[01:04:58.050 --> 01:04:58.970]  It's a hard challenge.
[01:04:59.150 --> 01:04:59.990]  Thank you for your question.
[01:05:00.050 --> 01:05:00.770]  Thank you.
[01:05:01.290 --> 01:05:01.850]  Next question.
[01:05:02.070 --> 01:05:02.330]  Thank you.
[01:05:07.290 --> 01:05:17.270]  So, I just want to say first, when smile.amazon.com came out a while back, the first thing I did is I hooked EFF up to that.
[01:05:17.510 --> 01:05:18.570]  Oh, thank you for that.
[01:05:18.910 --> 01:05:22.670]  Every one of my Amazon purchases contributes to EFF.
[01:05:22.910 --> 01:05:23.550]  Thank you for that.
[01:05:23.650 --> 01:05:24.410]  That's really great.
[01:05:24.570 --> 01:05:25.730]  I really appreciate that.
[01:05:25.750 --> 01:05:26.870]  It's a charity I could be very proud of.
[01:05:27.190 --> 01:05:28.630]  I think you should be.
[01:05:28.710 --> 01:05:30.050]  I'm very happy to hear it.
[01:05:30.090 --> 01:05:30.730]  It warms my heart.
[01:05:30.850 --> 01:05:34.650]  I am also an annual donor to EFF despite being on the payroll.
[01:05:35.150 --> 01:05:35.590]  I'll bet you are.
[01:05:36.230 --> 01:05:41.230]  MIT Media Lab actually pays my fees at EFF.
[01:05:41.590 --> 01:05:43.430]  I'm an activist in residence at the Media Lab.
[01:05:43.530 --> 01:05:44.930]  So, I don't cost EFF anything.
[01:05:45.210 --> 01:05:49.570]  And I take some of the money that I get for working at EFF and give it back to EFF as a donation.
[01:05:49.690 --> 01:05:50.590]  It's so important.
[01:05:50.710 --> 01:05:51.590]  It's a very worthy charity.
[01:05:52.530 --> 01:05:57.050]  So, I guess the government had its werewolf moment with the Internet.
[01:05:57.050 --> 01:06:05.110]  I thought the Internet was originally created to prevent governments, renegade governments, from taking over.
[01:06:05.990 --> 01:06:16.110]  So, I really liked the idea that you had about personal motivations of possibly government officials, CEOs, or whatever.
[01:06:16.590 --> 01:06:26.010]  And I'm wondering what you can do to even extend that so that it just makes so much sense for each of those people to make it better.
[01:06:26.750 --> 01:06:27.190]  Yeah.
[01:06:27.750 --> 01:06:34.170]  You know, I'm always on the lookout for things like kinds of agreements that we can make that lock stuff open.
[01:06:34.490 --> 01:06:46.030]  So, you know, Brewster Cale, who runs the Internet Archive and created the first two search engines, he has this idea that we can build peer-to-peer software that runs in JavaScript that only uses calls that are made by Google Docs.
[01:06:46.130 --> 01:06:48.290]  And so, to block it, you have to block Google Docs.
[01:06:48.390 --> 01:06:54.350]  So, like, we can kind of use Google Docs as an inhuman shield, you know, for keeping this stuff running.
[01:06:54.350 --> 01:06:56.070]  I really like that kind of idea.
[01:06:56.410 --> 01:07:07.970]  When Stuart Butterfield was still running Flickr, he had an API rule where he would allow total unfettered access to his API for any competitor that would allow total unfettered access to him.
[01:07:08.170 --> 01:07:17.250]  And so, basically, if you promise not to lock up your customers, then you can siphon off as many customers of ours as you can convince are doing the right thing.
[01:07:17.250 --> 01:07:25.310]  And it would be great to see that kind of formalized as a license term or like a fair trademark or something that Consumer Reports rounded up.
[01:07:25.450 --> 01:07:33.050]  I've talked a lot to Consumer Reports and other organizations like them about maybe having a stamp of approval that doesn't say this thing is secure.
[01:07:33.290 --> 01:07:39.450]  It says that whatever problems there are with this, there won't be any structural impediments to violating them.
[01:07:39.450 --> 01:07:47.130]  So, like calling up manufacturers before you review it and saying, do you consider your device to be an effective means of access control under Section 12-1 of the DMCA?
[01:07:47.250 --> 01:07:53.110]  And if they say yes, you put a little red X next to the product that says if there's a vulnerability in this, people might go to jail for disclosing it.
[01:07:53.350 --> 01:07:59.370]  And then you won't know about it until it's too late because you and everyone else who bought one just got hit by some rando and an opportunistic attack.
[01:07:59.370 --> 01:08:18.410]  So, I think that there are lots of ways that we can like insert these kind of normative, legal, technical combinations together in a way that help us kind of take... grab little pieces of territory and wall them off from being closed off just one little piece after another.
[01:08:18.410 --> 01:08:24.370]  I guess my biggest worry is when vertically integrated monopolies are able to form.
[01:08:24.630 --> 01:08:34.650]  New York City is about to implement this major public Wi-Fi, but I believe it's just one monopoly vendor who gets something very wrong there.
[01:08:34.850 --> 01:08:40.490]  Yeah, we have an overall problem with monopolistic forces in markets right now.
[01:08:40.770 --> 01:08:43.210]  You know, a lot of like we talk about consolidation in the Internet.
[01:08:43.490 --> 01:08:45.290]  It's not just consolidation in the Internet.
[01:08:45.490 --> 01:08:47.990]  It's consolidation in the private prison industry and oil.
[01:08:47.990 --> 01:08:50.130]  And hamburgers and agribusiness.
[01:08:50.390 --> 01:08:51.990]  And like everything is consolidating.
[01:08:52.770 --> 01:08:56.210]  The Internet is like an epiphenomenon of it, but it's also enabled by it.
[01:08:56.370 --> 01:09:04.090]  You know, like the Internet has made it possible for businesses to coordinate monopolistic practices across territories in ways that wouldn't have been sustainable before.
[01:09:04.390 --> 01:09:12.790]  The other thing it's done is it's made it possible to stabilize societies that would otherwise be made unstable by the great inequities of this system.
[01:09:12.790 --> 01:09:24.950]  So, you know, Tomat Piketty in Capital in the 21st Century, he keeps returning to the amount of inequality in France in 1789 when they built the guillotines as kind of the moment at which you know you've reached peak inequality.
[01:09:25.250 --> 01:09:28.190]  And he says, but we're past there now, right?
[01:09:28.190 --> 01:09:37.170]  And one of the reasons we're past there is that we have mass surveillance as a means of stabilizing otherwise intrinsically unstable situations.
[01:09:37.530 --> 01:09:48.570]  You know, the Turkish roundup of 6,000 judges and 15,000 academics and now it seems like there's 50,000 people who've been put on lists in Turkey.
[01:09:48.570 --> 01:09:53.210]  That was made possible by mass surveillance and by IT.
[01:09:53.690 --> 01:09:55.350]  Anyway, thank you very much for your question.
[01:09:55.590 --> 01:09:55.990]  Thanks.
[01:09:56.310 --> 01:09:56.610]  Hey.
[01:09:57.790 --> 01:09:58.370]  Hey there.
[01:09:59.350 --> 01:10:00.050]  I'm Crowbar.
[01:10:00.430 --> 01:10:03.310]  I just want to say thank you so much for your talk.
[01:10:03.470 --> 01:10:07.390]  Like you have such great ideas and I just think it's great.
[01:10:07.670 --> 01:10:17.650]  I just think it's awesome that you have these like concrete research based like techy things that you know and do, but you're also a fiction writer, like a completely different world.
[01:10:17.830 --> 01:10:23.990]  And as someone who's a writer and has started getting into fiction, I just think it's cool.
[01:10:24.190 --> 01:10:24.290]  Thank you.
[01:10:24.290 --> 01:10:27.150]  And I like maybe you can... Okay, question.
[01:10:27.310 --> 01:10:29.190]  What inspires you to write fiction?
[01:10:29.690 --> 01:10:32.750]  So there's lots of reasons to write fiction.
[01:10:32.890 --> 01:10:37.430]  I think fiction, like the more I do of it, the weirder fiction gets as like a prospect.
[01:10:37.430 --> 01:10:44.530]  Like if you think about it, responding to fiction is like deeply irrational, right?
[01:10:44.670 --> 01:10:50.910]  Like the people to whom bad things happen in fiction, they're not real.
[01:10:50.950 --> 01:10:53.210]  And so you shouldn't care about them, right?
[01:10:53.350 --> 01:10:56.190]  Like they're like literally inconsequential.
[01:10:56.350 --> 01:11:00.710]  Like the yogurt you digested this morning with breakfast was alive and now it's dead.
[01:11:00.890 --> 01:11:02.990]  That's more tragic than Romeo and Juliet, right?
[01:11:02.990 --> 01:11:05.510]  Because they were never alive, right?
[01:11:07.190 --> 01:11:17.330]  And so there's this interesting thing that happens, some kind of hack on the way that we experience empathy in other people.
[01:11:17.430 --> 01:11:22.710]  And I think it's that we have a kind of simulator that we use to experience other people.
[01:11:22.850 --> 01:11:29.010]  You know, you meet someone and you start to build a model of them in your mind and you can interrogate that model later.
[01:11:29.010 --> 01:11:33.010]  Like, you know, like you can ask yourself, what would my mom think of me now, right?
[01:11:33.150 --> 01:11:37.650]  You can tell when someone that you love would be proud or disappointed in you.
[01:11:38.330 --> 01:11:45.150]  You also are able to do things like say, can I trust someone, you know, based on your model of them?
[01:11:45.270 --> 01:11:47.490]  And I think that part of your brain is super naive.
[01:11:47.810 --> 01:11:54.730]  I think that it doesn't know whether it's receiving input about imaginary or real people, because it can form models of people you've never met, right?
[01:11:54.730 --> 01:11:56.130]  You can run into someone like...
[01:11:56.130 --> 01:12:05.050]  I was once at this iCommons event in Rio and Jean-Marc Souffron, who runs Wikipedia France, ignored all of the warnings not to go on the Copacabana beach with your laptop.
[01:12:05.290 --> 01:12:07.850]  And four guys with machetes robbed him of his laptop, right?
[01:12:08.250 --> 01:12:13.030]  And then like, he came back and he said, if you see four guys with machetes, you should be really careful.
[01:12:15.230 --> 01:12:21.890]  And none of us saw the four guys with the machetes, but we were able to form an opinion about people who may not have existed, right?
[01:12:21.890 --> 01:12:23.050]  I think he was telling the truth.
[01:12:23.050 --> 01:12:26.210]  I can't imagine why he wouldn't have been, but sometimes people lie, right?
[01:12:26.390 --> 01:12:28.610]  And we were still able to form opinions about them.
[01:12:28.750 --> 01:12:33.030]  And so I think that when you read fiction, you experience...
[01:12:33.570 --> 01:12:39.590]  You build up a model in your mind of imaginary people, and that's how we experience empathy, right?
[01:12:39.650 --> 01:12:41.170]  We subject the people in our model to it.
[01:12:41.210 --> 01:12:53.030]  When someone says, oh, you know, Fred fell down a flight of stairs and broke his leg, you kind of take your model of Fred and tumble him down a flight of stairs and imagine what he would go through in the same way that if you think of yourself as like inviting Fred out to dinner,
[01:12:53.190 --> 01:12:55.330]  you ask yourself whether or not he'd split the check with you.
[01:12:55.510 --> 01:12:58.210]  And so that's how we experience empathy.
[01:12:58.310 --> 01:13:00.450]  And we experience it for these imaginary people.
[01:13:01.770 --> 01:13:04.590]  And I think that that's true of writers as well as readers.
[01:13:04.870 --> 01:13:07.310]  So I think when you start writing, there's...
[01:13:07.310 --> 01:13:09.390]  It feels absurd.
[01:13:09.390 --> 01:13:11.690]  It feels like you're putting on a puppet show for yourself.
[01:13:11.850 --> 01:13:13.610]  Like, hey, kids, let's go on a quest.
[01:13:13.610 --> 01:13:15.250]  That sounds great, you know?
[01:13:16.150 --> 01:13:23.270]  But this weird thing happens when you're writing where suddenly you start to know what your characters are going to do.
[01:13:23.430 --> 01:13:39.450]  And I think that that is driven by the model in your brain getting enough information that it's making inferences and telling you in a kind of subliminal way what it is you can expect these imaginary people that it doesn't know are imaginary are gonna do.
[01:13:39.530 --> 01:13:41.390]  It's kind of like, you know, you're breathing your own farts, right?
[01:13:41.390 --> 01:13:42.350]  Like, you're...
[01:13:43.070 --> 01:13:46.190]  This thing is getting data from itself, but it doesn't know it.
[01:13:46.370 --> 01:13:48.350]  So I went to summer camp with a guy.
[01:13:48.490 --> 01:13:49.090]  It was very sad.
[01:13:49.250 --> 01:13:51.810]  He was profoundly epileptic.
[01:13:52.030 --> 01:14:04.770]  And one of the last-ditch things that they do if you're experiencing brain damage from continuous seizures is they sever your corpus callosum, the electrical bundle that joins the two lobes of your brain to stop seizures from spreading from one side to the other.
[01:14:05.210 --> 01:14:15.330]  And after he had this surgery, which was sadly shortly before he died, he... if you covered one of his eyes and then asked him about something, he could tell you what it was, but not what it was called.
[01:14:15.790 --> 01:14:19.190]  And if you covered the other eye, he could tell you what it was called, but not what it was for.
[01:14:19.430 --> 01:14:35.170]  But when he spoke it aloud, his ears formed a free space acoustic loop between the electrically isolated parts of his brain, just like all that research that you keep seeing at, like, hacker cons about air gap machines that smuggle information out through their fans or through,
[01:14:35.170 --> 01:14:43.470]  you know, supersonic chirps or whatever, your brain can form free space loops between parts of itself that normally don't directly talk.
[01:14:43.630 --> 01:14:52.790]  And I think when you write, you form a free space optical loop between the words that you're writing and the part of your brain that creates subliminal opinions about people.
[01:14:52.970 --> 01:14:59.390]  And you end up, like, having these parts of your brain that normally don't talk to each other or talk to each other.
[01:14:59.390 --> 01:15:00.930]  And it's really exciting.
[01:15:01.250 --> 01:15:08.270]  And it allows you as a fiction writer to invoke not what something is but how it feels.
[01:15:08.490 --> 01:15:16.630]  You know, before Orwell wrote 1984, if during the, you know, the peace evident after the war you had said, well, we've got all this money lying around.
[01:15:16.730 --> 01:15:19.910]  We've just done all this amazing technological development during the war.
[01:15:19.970 --> 01:15:22.010]  We've got money lying around because we don't have to buy tanks anymore.
[01:15:22.010 --> 01:15:22.890]  What should we do with it?
[01:15:23.070 --> 01:15:27.150]  Someone might have said, okay, well, let's put cameras everywhere because now we know how to make cameras and TV.
[01:15:27.290 --> 01:15:28.290]  That all came out of the war.
[01:15:28.290 --> 01:15:31.350]  We'll put cameras everywhere and we can find all the crime, right?
[01:15:31.710 --> 01:15:35.730]  It's like the Sermon on the Mount, you know, his eye is on the sparrow.
[01:15:35.850 --> 01:15:37.570]  We will be men as gods, right?
[01:15:37.610 --> 01:15:40.830]  We will know everything going on everywhere and we'll find all the crime.
[01:15:41.230 --> 01:15:44.790]  And in, like, in 1947, that might have seemed like a rational argument.
[01:15:44.790 --> 01:15:46.410]  It would be hard to counter it.
[01:15:46.450 --> 01:15:49.010]  Anything you could say about it would be like, that would feel creepy.
[01:15:49.110 --> 01:15:50.750]  It would be kind of fuzzy, right?
[01:15:51.010 --> 01:15:57.170]  But after 1948, 1949, when Orwell published 1984, suddenly we had an adjective.
[01:15:57.510 --> 01:15:59.350]  We could call it Orwellian, right?
[01:15:59.430 --> 01:16:19.470]  We could say that experiencing the experience of living under surveillance is a thing that you can know intrinsically and atavistically by reading this book and by having your emulation engine, your empathy engine spin up and make you feel vicariously what that kind of surveillance is like.
[01:16:19.470 --> 01:16:27.390]  And I think that that makes fiction this incredibly powerful political tool as well as, like, a very powerful aesthetic and cognitive one.
[01:16:27.710 --> 01:16:35.350]  And incidentally, I think one of the great fights that we have in fiction, which is about fan fiction, arises from this phenomenon as well.
[01:16:35.470 --> 01:16:37.970]  For you to enjoy a book, you have to emulate the characters.
[01:16:38.230 --> 01:16:42.490]  And once you've emulated the characters, they don't stop being emulated just because you've closed the book.
[01:16:42.630 --> 01:16:44.050]  You know, your emulator is naive.
[01:16:44.510 --> 01:16:49.610]  And so, after you finish the book, those stories go on in your mind and it's natural that you want to write them down.
[01:16:49.710 --> 01:16:55.350]  In fact, if the characters aren't still live in your mind after you finish the book, they probably weren't live to begin with and you didn't enjoy the book.
[01:16:55.490 --> 01:16:58.350]  So, for the book to be successful, you have to emulate the characters.
[01:16:58.610 --> 01:17:03.450]  And so, the writer has the characters emulated in their head and you have the characters emulated in your head.
[01:17:03.670 --> 01:17:08.490]  And the writer and you have a dispute about who has the true future history of those characters.
[01:17:08.690 --> 01:17:11.570]  And I think that's where the tension springs from.
[01:17:11.570 --> 01:17:21.990]  And I think if writers came to understand that fanfic only occurs where people have experienced your book fully, that maybe some of that tension would erode too.
[01:17:23.010 --> 01:17:23.790]  Next question.
[01:17:24.210 --> 01:17:25.750]  How are we doing for time, by the way?
[01:17:26.610 --> 01:17:27.410]  We have lots?
[01:17:27.630 --> 01:17:27.750]  Okay.
[01:17:27.990 --> 01:17:28.590]  Yeah, next question.
[01:17:28.730 --> 01:17:28.870]  Go ahead.
[01:17:29.050 --> 01:17:29.350]  Thank you, Cory.
[01:17:29.770 --> 01:17:34.670]  Thank you for saying that, because certainly I had a lot of empathy for Marcus Yellow during his exploits.
[01:17:35.890 --> 01:17:36.730]  He's mine.
[01:17:37.110 --> 01:17:39.070]  You may not... No, you're fine.
[01:17:40.410 --> 01:17:43.090]  But that's actually a good segue to what I was going to ask.
[01:17:43.270 --> 01:17:47.050]  Namely, that I think empathy is hugely important in debates of this nature.
[01:17:47.270 --> 01:17:55.350]  And that a lot of the conflicts in this, when it comes to real people, talking with real people, is a lack of empathy or a lack of understanding.
[01:17:56.090 --> 01:18:07.570]  And even people... when you start to explain these things to people, you either get people who don't understand them, don't want to understand them, or do understand them and think, oh, that's nice, but don't think it's such a big deal.
[01:18:07.570 --> 01:18:07.970]  Mm-hmm.
[01:18:08.150 --> 01:18:16.050]  What I've certainly found in my own experience to be the best... to be the best convincing tool, at least on the receiving end, is when you have your worldview shattered.
[01:18:16.410 --> 01:18:17.690]  You know, I say that very casually.
[01:18:17.710 --> 01:18:23.570]  I've had my worldview shattered, you know, with very visceral experiences, and it's kind of hard to go back to the way things were after that.
[01:18:23.890 --> 01:18:23.930]  Sure.
[01:18:23.930 --> 01:18:30.710]  When you mentioned the example of the people in your simulation who understand after this OPM hack, they can't go back to their previous way of thinking.
[01:18:30.890 --> 01:18:30.910]  Sure.
[01:18:30.910 --> 01:18:34.710]  So I think of that as the best way to move the debates forward on this.
[01:18:34.810 --> 01:18:40.330]  How would you recommend, I don't know, casually shattering world... someone's worldview while minimizing the potential consequences?
[01:18:40.330 --> 01:18:46.830]  So, I mean, I think that, like... So peak indifference is a really interesting idea on these lines, right?
[01:18:47.130 --> 01:18:48.890]  Because... Think of carbon, right?
[01:18:48.990 --> 01:18:54.370]  Like, all that carbon is out there in the atmosphere, and there's probably nothing we can do about it.
[01:18:54.470 --> 01:18:59.510]  It's probably, like, there... And whatever is gonna happen as a consequence of that carbon is gonna happen.
[01:18:59.690 --> 01:19:04.270]  And so the argument we're having is not about the carbon that's already out there, it's about the carbon we might emit.
[01:19:04.550 --> 01:19:06.430]  And the same is true of personal information.
[01:19:06.670 --> 01:19:21.250]  And so we're in a kind of race to see whether the consequences of carbon arrive soon enough to stop us putting so much more carbon that they become irreversible, or whether the lag between the action and the consequence is so great that we put ourselves in terminal danger.
[01:19:21.390 --> 01:19:22.830]  And the same is true of private information.
[01:19:23.090 --> 01:19:30.810]  And, you know, I spent the last 15, 20 years, just like so many of you, trying to get people to care about the potential consequences of privacy.
[01:19:30.810 --> 01:19:36.850]  And in some ways, you know, it's... The benefit we have now is that we failed so terribly.
[01:19:37.110 --> 01:19:42.410]  And there's so much private information out there now that we're having privacy valdezes every week.
[01:19:42.470 --> 01:19:49.530]  And making people, you know, using those as touch points, rather than hypotheticals, you know, using actual stuff that happens.
[01:19:49.890 --> 01:20:06.970]  You know, that hack in San Francisco that made all the news stories about the family who had an IoT baby monitor that was very badly secured is one of the ones that that the researchers at DEF CON had presented on, presented Volnzen at DEF CON, which the manufacturer still had failed to patch.
[01:20:07.950 --> 01:20:16.610]  And the toddler kept saying that the phone, the toddler called the baby monitor the phone, the phone in the room was scaring him at night.
[01:20:16.790 --> 01:20:23.830]  And the mom walked past his room one night and heard a stranger's voice swearing at the kid and terrorizing the kid.
[01:20:23.850 --> 01:20:26.990]  And it was one of those monitors you could steer the camera on with an app.
[01:20:27.130 --> 01:20:33.810]  And she walked into the camera, swiveled to look at her and a stranger's voice said, uh-oh, mom's in the room, right?
[01:20:34.430 --> 01:20:52.270]  These like non-hypothetical hair on the back of your neck stand up moments are, I think, you know, if nothing comes of those moments apart from the ruination of those people's lives, it's actually worse than if we use those moments to convince other people to be safe,
[01:20:52.370 --> 01:20:52.510]  right?
[01:20:52.670 --> 01:20:55.930]  At the very least, maybe we can, we can salvage something of it.
[01:20:56.010 --> 01:20:58.130]  When you know, when life gives you SARS, you make SARS-Borilla.
[01:20:58.390 --> 01:21:08.070]  You know, we can, we can, we can, we can, we can, you know, use... I hate to use the word exploit, but we can, we can build on these experiences to stop them from recurring.
[01:21:08.350 --> 01:21:12.870]  It's the most tragic thing is for us not to learn the lesson of these moments.
[01:21:12.890 --> 01:21:37.010]  And our, our hope has got to be that we can race ahead of the harms of privacy, uh, breaches to armor ourselves, to defend ourselves against privacy breaches before, uh, we, we, um, it's too late before there's so much privacy carbon out there in these giant leaky databases that it's kind of too late for us to salvage it before there's too much infrastructure built out that's designed with privacy
[01:21:37.010 --> 01:21:38.810]  as an afterthought or not there at all.
[01:21:39.330 --> 01:21:43.890]  And I think that, you know, there are multiple ways that we can get there in addition to campaigning.
[01:21:44.130 --> 01:21:46.390]  I think there might be market forces on our side.
[01:21:46.530 --> 01:21:52.710]  I think of, um, class action lawyers as a kind of Monte Carlo attack on the American judicial system.
[01:21:52.910 --> 01:22:01.910]  They're trying different fact patterns and different, uh, legal theories on judges to see if they can finally get a company to internalize the full cost of a breach.
[01:22:02.070 --> 01:22:11.230]  You know, Home, Home Depot's breach, they paid about 33 cents per customer for breaching their data and then everyone got a gift certificate for credit monitoring.
[01:22:11.490 --> 01:22:17.730]  Uh, but, you know, something like 1% of those people will probably have their houses stolen as a consequence of it.
[01:22:17.890 --> 01:22:22.750]  So the really the remedy should have been 1% of all the real estate owned by everyone who'd ever shopped at home hardware.
[01:22:23.070 --> 01:22:39.430]  And when that award comes down and it may, if we have long enough, uh, sustained enough, uh, uh, litigation attempts for, for these breaches, then, you know, the underwriters who insured them will suddenly show up at the doors of every company they've written a policy on and say,
[01:22:39.470 --> 01:22:48.450]  we'd like to talk to you about what you're collecting and what you're retaining and whether or not you have a business case for it and how much we're going to charge you for it and whether it's still worth your while.
[01:22:48.710 --> 01:22:59.150]  You know, there was a time in which, um, you know, insurance companies knew nothing about fire prevention and the way we got sprinklers every 10 feet was not that they just developed it out of the goodness of their heart.
[01:22:59.230 --> 01:23:03.530]  It was that we, you can't build a building anymore and get it insured unless you have the sprinklers.
[01:23:03.550 --> 01:23:07.110]  Even without the building code, the sprinklers would be there because the insurers would insist on it.
[01:23:07.110 --> 01:23:20.610]  And one of our great risks, I think, to, to using markets to recover from this, this privacy situation we found ourselves in is, uh, forced arbitration is becoming a more common feature of those license agreements that we click on.
[01:23:20.830 --> 01:23:25.350]  And the courts have generally favored forced arbitration as something that is, uh, binding.
[01:23:25.570 --> 01:23:31.010]  And so forced arbitration says that, um, if, if you're harmed, first of all, you can't join a class action.
[01:23:31.590 --> 01:23:34.110]  And second of all, uh, you can't sue in a court.
[01:23:34.110 --> 01:23:38.450]  You go to these private pseudo courts that are owned by the people that you're suing.
[01:23:39.170 --> 01:23:44.530]  And those courts get to, and, you know, overwhelmingly fined in the favor of the people who, who pay their bills.
[01:23:45.230 --> 01:23:49.010]  Uh, it, forced arbitration is the, in the Pokemon Go agreement.
[01:23:49.510 --> 01:23:55.630]  Uh, you have 30 days, by the way, after signing up for Pokemon Go to send an email to them asking to be removed from forced arbitration.
[01:23:55.950 --> 01:23:57.430]  It's in Google Fiber agreements.
[01:23:57.550 --> 01:24:03.050]  If you have Google Fiber, you have 30 days from the change of their terms of service to opt out of their forced arbitration.
[01:24:03.050 --> 01:24:05.410]  It's in the Airbnb terms of service.
[01:24:05.770 --> 01:24:07.530]  It's in T-Mobile's terms of service.
[01:24:07.910 --> 01:24:15.550]  And forced arbitration could short circuit this by, uh, requiring all of us in society to pay the cost, to pay the cost of those breaches.
[01:24:15.550 --> 01:24:24.810]  Because when people lose their homes or their lives are destroyed or their children are terrorized, if the company whose indifference caused that to happen don't pay for it, it's not like it goes away.
[01:24:24.810 --> 01:24:27.330]  It becomes a social cost that the rest of us pay.
[01:24:27.530 --> 01:24:41.350]  And so if forced arbitration is allowed to continue to proliferate, I think we'll end up in a situation where it's very likely that the costs of these bad decisions will become more and more incumbent on us to pay rather than being, uh, internalized by the firms.
[01:24:41.470 --> 01:24:47.150]  But if we can get out from under forced, uh, arbitration, arbitration, I think that insurers and activist investors, right?
[01:24:47.290 --> 01:24:56.910]  Like people who put money into these companies are going to show up and ask the board of directors, ask this, the, the C-suite to defend their data collection and data handling processes.
[01:24:57.210 --> 01:25:04.410]  And, you know, right now one of the reasons that surveillance is so cost effective is that companies do the surveillance and then governments raid their troves, right?
[01:25:04.430 --> 01:25:12.930]  If you talk to cops or spooks or people in the military, they'll say, well, I trust Uncle Sam because he signs my paycheck, but I don't trust Google or Amazon or Facebook.
[01:25:13.230 --> 01:25:22.070]  And if you talk to people in Silicon Valley, they'll say, well, you know, governments are incompetent, but, uh, you know, Zuck isn't going to take dumb risks with my personal information because he's got too much riding on it.
[01:25:22.170 --> 01:25:35.070]  The reality is that governments, so long as they rely on being able to raid Facebook and Google and all these other companies in order to amass their databases, governments are never going to pass laws limiting their surveillance.
[01:25:35.250 --> 01:25:37.630]  There's no such thing as private surveillance or public surveillance.
[01:25:37.830 --> 01:25:39.270]  It's public-private surveillance.
[01:25:39.830 --> 01:25:43.670]  You know, the Stasi had one spook for every 60 people in East Germany.
[01:25:44.010 --> 01:25:47.550]  The NSA has got about one spook for every 10,000 people in the world.
[01:25:47.910 --> 01:25:59.250]  They've achieved a two and a half order of magnitude increase in the efficiency of their surveillance by having private companies do the heavy lifting for them, by having us do the heavy lifting for them, right?
[01:25:59.350 --> 01:26:09.570]  Our destruction rectangles are also microphones and cameras that know all the people that we know, know all the things that we talk to them about, know all the places that we go, and we foot the bill for it.
[01:26:09.650 --> 01:26:12.950]  Every month we pay the bill for it, and that's what makes surveillance cost effective.
[01:26:13.150 --> 01:26:21.310]  It's like a kind of mass scale version of the cultural revolution in China where they'd shoot your father in the head and send you a bill for the bullet, right?
[01:26:21.390 --> 01:26:22.730]  We pay the cost of it.
[01:26:22.830 --> 01:26:32.010]  And so if we can force firms and states to internalize these costs, then we could approach a solution not just through principle, but through markets.
[01:26:32.310 --> 01:26:40.530]  And that, again, like to the extent that we can convince people who don't care about principle that we're right, I think we get a lot further than if we have to rely on principle alone.
[01:26:40.850 --> 01:26:47.470]  As Upton Sinclair said at the start of my slideshow there, nothing's harder than convincing the man of something that his paycheck depends on him not understanding.
[01:26:48.290 --> 01:26:48.790]  Thank you.
[01:26:48.990 --> 01:26:49.490]  Next question.
[01:26:51.910 --> 01:26:59.670]  So my question goes back to your comment about the situation in which you were with a bunch of spooks, a bunch of people all over and you were doing a simulation.
[01:27:00.810 --> 01:27:04.150]  And you said that sort of the the breaks on the situation were the spooks.
[01:27:04.430 --> 01:27:04.530]  Yeah.
[01:27:04.950 --> 01:27:07.190]  And so I'm curious because they'd had their stuff stolen.
[01:27:07.570 --> 01:27:07.650]  Right.
[01:27:07.890 --> 01:27:21.570]  And so I'm curious if they've participated in a lot of these conversations more having sort of experienced the visceral, you know, tragedy of having your personal information in the hands of people who you don't think will do good things with it.
[01:27:22.250 --> 01:27:28.190]  And sort of more generally, do you think that there are people who will join the conversation after they have that happen?
[01:27:28.410 --> 01:27:29.230]  Yeah, I think so.
[01:27:29.390 --> 01:27:31.190]  I mean, I think that the risk is nihilism, right?
[01:27:31.310 --> 01:27:35.610]  So like all of these people understand now that it was terrible that their data was collected.
[01:27:36.010 --> 01:27:38.510]  And I think that if you make reference to it, it's a touchstone.
[01:27:38.630 --> 01:27:43.950]  I don't spend a lot of time with spooks or cops or people in the military, but every now and again, my path intersects with them.
[01:27:44.070 --> 01:27:48.110]  And when you invoke OPM, they immediately understand what you're talking about.
[01:27:48.810 --> 01:27:52.310]  And they become really head up about it.
[01:27:52.550 --> 01:28:00.830]  They feel correctly betrayed by incompetence and indifference to something that they had really implicit trust in.
[01:28:01.470 --> 01:28:06.890]  And so the risk, though, is that that betrayal just turns into nihilism, right?
[01:28:06.930 --> 01:28:07.730]  It's all screwed up.
[01:28:07.810 --> 01:28:08.790]  There's nothing we can do.
[01:28:09.150 --> 01:28:11.510]  I guess this is what our future looks like.
[01:28:11.690 --> 01:28:16.530]  And if we can convince them that there is an intercession they can make, right?
[01:28:16.610 --> 01:28:25.290]  In that moment when you have that conversation, if you can say, this didn't occur as like an emergent property of networks, right?
[01:28:25.370 --> 01:28:28.570]  Someone made a bad decision that they should have known was bad.
[01:28:28.730 --> 01:28:35.350]  And if they didn't know it was bad, it's because they deliberately chose not to research it because they had a guess of what they would find.
[01:28:35.450 --> 01:28:41.130]  And it was that, for example, their favorite contractor wouldn't be a good handler of this data.
[01:28:42.210 --> 01:28:44.310]  And that we can take steps.
[01:28:44.470 --> 01:28:50.090]  We can... it is not implicit to computers that they retain their log files forever, right?
[01:28:50.190 --> 01:29:03.650]  Do you remember in the old days of web servers when every IT manager would eventually have to go into a data center at two in the morning because they forgot to write a log rotation script and the server had shut down because we forgot to delete our logs,
[01:29:03.850 --> 01:29:04.070]  right?
[01:29:04.270 --> 01:29:07.490]  Logs used to be like the pubic lice of the Internet, right?
[01:29:07.670 --> 01:29:09.850]  We couldn't get rid of them, right?
[01:29:10.050 --> 01:29:13.650]  And then one day, someone was like, hey, what about the surveillance capitalism thing?
[01:29:13.890 --> 01:29:20.570]  No one came down off a mountain with two stone tablets saying, thou shalt subject thine logs to supervised machine learning, right?
[01:29:20.670 --> 01:29:25.030]  Those were like decisions people made, and they're decisions we can change.
[01:29:25.790 --> 01:29:38.010]  And you know, that's why I'm interested in figuring out ways to, like, convince people that something can be done, convince them that it's in their economic interest to do it, convince them that it's in their political interest to do it, convince them that legally it's what they should do,
[01:29:38.010 --> 01:29:44.930]  And finding, you know, in that Larry Lessig way, law, code, norms, and markets, you know, to make a change, right?
[01:29:45.550 --> 01:29:48.590]  We got rid of smoking, which we've largely done, right?
[01:29:48.710 --> 01:29:51.590]  Smoking is like, I used to be a smoker, I'm not a smoker anymore.
[01:29:51.830 --> 01:29:57.330]  And in part, I'm not a smoker anymore, because not being a smoker got a lot easier, and being a smoker got a lot harder.
[01:29:57.510 --> 01:30:11.290]  And the way we got there was by changes in markets and code and law and norms, where fewer people would have you around, it cost more, the penalties for violating it were more... I remember we used to ride the Greyhound bus, and we'd go into the bathroom and smoke,
[01:30:11.370 --> 01:30:13.430]  and the driver would pretend they didn't see it, right?
[01:30:13.710 --> 01:30:15.470]  Now, they take you off the bus in cuffs.
[01:30:15.570 --> 01:30:17.110]  That is not a good response.
[01:30:18.070 --> 01:30:20.790]  But it certainly reduced the amount of smoking that took place, right?
[01:30:20.930 --> 01:30:25.250]  Normatively, and legally, and economically, it's all changed.
[01:30:25.410 --> 01:30:26.590]  And so I think we can get there.
[01:30:27.250 --> 01:30:27.970]  Five more minutes.
[01:30:28.110 --> 01:30:29.770]  So last question, make it a great one.
[01:30:29.990 --> 01:30:30.650]  No pressure.
[01:30:32.790 --> 01:30:34.170]  Make questioning great again.
[01:30:34.270 --> 01:30:35.890]  Right, make questioning great again.
[01:30:36.090 --> 01:30:42.690]  Many, if not most, eight to ten-year-olds are given the little distraction rectangles to carry around all day.
[01:30:43.150 --> 01:30:50.030]  Do you have any ideas on how to raise their awareness without scaring them, et cetera?
[01:30:50.190 --> 01:30:55.170]  Yeah, how do you raise kids to be privacy aware without scaring them, or just...
[01:30:55.170 --> 01:30:56.830]  Or even with scaring them, frankly.
[01:30:56.930 --> 01:30:58.190]  How do you... what do you do?
[01:30:58.190 --> 01:30:59.050]  It's tough.
[01:30:59.590 --> 01:31:02.310]  So I think that... you know who, like, my rabbi is on this stuff?
[01:31:02.470 --> 01:31:03.430]  It's Dana Boyd, right?
[01:31:03.630 --> 01:31:05.890]  And she runs this thing called the Data and Society Centre.
[01:31:06.030 --> 01:31:06.790]  She's amazing.
[01:31:07.110 --> 01:31:11.850]  She wrote this book called It's Complicated, which is this incredible book about how young people use networks.
[01:31:12.010 --> 01:31:17.550]  Her doctoral work was 15 years of studying, as an anthropologist, how marginalized young people use networks.
[01:31:18.390 --> 01:31:19.810]  And she has a lot of insights.
[01:31:19.910 --> 01:31:21.910]  First of all, kids generally do value their privacy.
[01:31:21.910 --> 01:31:24.350]  They just value it against the wrong people, right?
[01:31:24.350 --> 01:31:29.830]  Like, they're really worried about the bully at school and their parents and their teacher getting into their stuff.
[01:31:30.210 --> 01:31:32.910]  And they don't think about cops, governments, and future employers.
[01:31:33.270 --> 01:31:40.770]  And one of the, like, structural problems we have with helping kids become good...
[01:31:40.770 --> 01:31:49.670]  Have good privacy instincts is that our first line of defense for kids in networks has become the censoring proxy, right?
[01:31:49.970 --> 01:32:00.910]  And so we try to, like, like, as though there's a boiler room somewhere that's big enough to hold enough prudes to separate all the pages on the Internet into pages that are safe for kids and pages that aren't.
[01:32:01.050 --> 01:32:05.930]  Or that you could, like, make a regex that's so gnarly that it could do this on an automated basis.
[01:32:06.870 --> 01:32:10.370]  And the thing about a censoring proxy is it's also a surveillance tool.
[01:32:11.050 --> 01:32:15.830]  Because in order to make sure that bad clicks don't go through, you have to capture all the clicks.
[01:32:16.130 --> 01:32:23.130]  And so we, perforce, punish children who take any affirmative step to protect their privacy.
[01:32:23.390 --> 01:32:25.950]  So I don't know, like, how we get kids interested in privacy.
[01:32:26.170 --> 01:32:26.610]  That's a...
[01:32:26.610 --> 01:32:27.850]  Like, I mean, I kind of know.
[01:32:27.930 --> 01:32:29.950]  We tell them to do it and we encourage them, whatever.
[01:32:30.150 --> 01:32:34.050]  But there's a certain intrinsic interest in privacy that kids have.
[01:32:34.110 --> 01:32:35.650]  But it's privacy from ourselves.
[01:32:36.170 --> 01:32:40.390]  And I think that kids understand that actions matter more than words.
[01:32:40.550 --> 01:32:56.330]  When you tell kids your privacy is as precious and irrecoverable as your virginity, but then we tell them that any affirmative step they take to protect it is punishable by immediate expulsion from school, they understand that we're talking bollocks, right?
[01:32:56.850 --> 01:33:04.310]  That, like, if you want your kids not to smoke, you can't tell them that smoking is bad for them while lighting the new one before butting it out in the ashtray.
[01:33:04.310 --> 01:33:10.270]  And so if we raid our kids' privacy and treat it as though it has no value, we will never convince them as it has value.
[01:33:10.470 --> 01:33:21.790]  So what if our school curriculum was based on teaching kids to jailbreak every device, to circumvent every proxy, and to become hardcore privacy ninjas, right?
[01:33:22.050 --> 01:33:31.650]  As opposed to becoming obedient and compliant users of surveillance where at least the kids who did care about privacy would do something about it.
[01:33:32.110 --> 01:33:44.070]  And, you know, I think that it's tough because zero tolerance plus the Computer Fraud and Abuse Act means that kids who do try that in school are apt to get expelled if not arrested, if not jailed.
[01:33:44.150 --> 01:33:47.410]  But I think that there's, like, a middle path, and I've written about this a little.
[01:33:47.610 --> 01:33:56.270]  We could, like, develop curriculum around this because every teacher and every student knows that that sensor wear doesn't work, that it over blocks and under blocks.
[01:33:56.570 --> 01:34:10.390]  That in a network of hundreds of billions of pages, a 1% error rate means that there's more horrific pornography that kids can see than all of the pornography that everyone has seen up to the year 2000 and the entire history of the human race.
[01:34:10.390 --> 01:34:20.110]  And at the same time that there are hundreds of libraries of Congress worth of things that are not pornography that are blocked and not in a kind of Gaussian distribution.
[01:34:20.170 --> 01:34:24.470]  It's lumpy around things like reproductive health, LGBT issues, and so on.
[01:34:24.850 --> 01:34:35.210]  And every teacher has had the experience of, like, doing a lesson plan and then having the thing that they were going to show the kids in the afternoon blocked over the lunch break and having to hand out, you know, photocopies and, like, have them do,
[01:34:35.210 --> 01:34:39.090]  you know, standardized test prep or something because the lesson is gone.
[01:34:39.490 --> 01:34:47.010]  So what if we ask kids, instead of asking kids to break this stuff, which they do anyways, if we said to them, we want you to be anthropologists of this stuff.
[01:34:47.090 --> 01:34:50.730]  We want you to go around and interview other kids and document how they break it.
[01:34:50.850 --> 01:34:55.250]  Document its unsuitability for use in schools as a technical matter.
[01:34:55.430 --> 01:34:56.810]  It doesn't work.
[01:34:57.070 --> 01:34:58.410]  Kids who want to get past it can.
[01:34:58.910 --> 01:35:06.290]  Then interview students about things that have been over and under block, things they wish they hadn't seen, which they did see, things that they needed to see that they couldn't.
[01:35:06.290 --> 01:35:10.190]  And interview teachers about ways that it's intervened in their lesson plan.
[01:35:11.070 --> 01:35:21.470]  And then ask them to... teach them to use MuckRock and to file FOIA requests to find out who supplies their software, what else they do, how much their school board is paying them.
[01:35:21.550 --> 01:35:24.450]  Teach them to use public record requests to find out who their other customers are.
[01:35:24.810 --> 01:35:27.130]  Because SenseAware is not developed for schools.
[01:35:27.550 --> 01:35:32.370]  SenseAware is developed for autocratic regimes in the Middle East and the former Soviet republics in Asia.
[01:35:32.370 --> 01:35:36.450]  And then it is repurposed for white-collar workers, prisons and schools.
[01:35:36.970 --> 01:35:37.050]  Right?
[01:35:37.450 --> 01:35:44.290]  And so, war criminals capture all of our children's cliques and warehouse them in insecure places.
[01:35:45.010 --> 01:35:46.550]  And kids can document that.
[01:35:46.690 --> 01:35:49.630]  That's a thing that kids are capable of discovering and documenting.
[01:35:49.790 --> 01:35:52.070]  And those are important informational skills to be able to learn.
[01:35:52.070 --> 01:35:54.490]  And then present it to your Board of Education.
[01:35:54.810 --> 01:35:56.510]  Present it to citizens meetings.
[01:35:56.650 --> 01:35:57.770]  Present it to the PTA.
[01:35:58.070 --> 01:35:58.090]  Wow.
[01:35:58.250 --> 01:36:03.650]  Present it during constituency meetings for people who are stumping for city council in this election season.
[01:36:03.650 --> 01:36:15.370]  And say, we found out that our school board is diverting X hundreds of thousands of dollars to this senseAware that kids trivially circumvent, that blocks all of this stuff, that let us see all of this stuff we wish we could unsee.
[01:36:15.370 --> 01:36:24.490]  And the companies that get to spy on everything we do, they're the ones who allowed Muammar Gaddafi to spy on his people and make enemies' lists and figure out who to execute.
[01:36:24.850 --> 01:36:24.930]  Right?
[01:36:25.070 --> 01:36:26.030]  Like, that's what we need.
[01:36:26.310 --> 01:36:29.090]  That's, I think, an exercise that can help kids.
[01:36:29.890 --> 01:36:30.330]  Thank you.
[01:36:30.330 --> 01:36:30.710]  So, thank you.
[01:36:30.830 --> 01:36:31.310]  We're out of time?
[01:36:31.810 --> 01:36:32.390]  All right.
[01:36:32.510 --> 01:36:33.610]  Thank you all very much.
[01:36:33.730 --> 01:36:35.090]  Thank you, Emmanuel and the HOPE team.
[01:36:35.390 --> 01:36:36.270]  This is great.
[01:36:36.450 --> 01:36:37.990]  It's a lifelong dream come true.
[01:36:38.310 --> 01:36:39.210]  Support EFF.
[01:36:39.350 --> 01:36:40.230]  Support ACLU.
[01:36:40.330 --> 01:36:40.730]  Thank you.
[01:36:40.730 --> 01:36:41.130]  Thank you.
[01:36:41.270 --> 01:36:41.770]  Thank you.
[01:36:51.720 --> 01:36:52.860]  Thank you.