[00:01.840 --> 00:12.120] So, yeah, just to repeat, I'll give a brief history of what EFF is if you are here and you're just kind of like, oh, okay, ask the EFF. [00:12.280 --> 00:12.820] I don't know what that is. [00:12.900 --> 00:14.040] It'll come to this talk anyway. [00:16.160 --> 00:19.360] And then we'll go and introduce ourselves down the line. [00:19.360 --> 00:35.340] And so EFF was founded in 1990 as really the first organization to defend the rights of Internet users and those that are exerting their rights on this new platform. [00:35.340 --> 00:50.460] It was before the web and the web was more of like a, in 1993 that it started, but it was, so we were founded in 1990 and on this kind of a case, Steve Jackson games was raided by the secret service. [00:51.760 --> 00:58.780] And they, Steve Jackson games was accused of providing hacker secrets to the public. [00:59.260 --> 01:05.180] It was just a, basically a card game based on the GURPS role-playing tabletop role-playing game. [01:05.180 --> 01:11.840] Uh, and so we were there, we defended their rights to publish this game. [01:12.000 --> 01:21.360] We, throughout the nineties, we defended the right to encryption in a landmark case called, uh, Bernstein versus DOJ or DOJ versus Bernstein. [01:21.580 --> 01:32.820] Uh, and, uh, where, uh, Daniel Bernstein was, uh, basically accused of, of, um, and distributing, uh, uh, munitions. [01:32.820 --> 01:35.720] It was categorized as munitions, which was cryptography. [01:35.880 --> 01:39.720] Cryptography was categorized as a munition at that time. [01:40.000 --> 01:52.300] Um, so we've been there all along, um, with, um, the fight, uh, again, SOPA PIPA with a fight against, uh, all of these, uh, terrible legislation coming down the pipeline. [01:52.300 --> 01:57.260] And also, um, you know, we, we, so we comprise of three teams. [01:57.820 --> 02:03.020] We're, uh, activists, we're lawyers and we're technologists. [02:03.340 --> 02:19.120] Um, so we develop technologies, um, like, you know, uh, we were formulative in the certificate authority, let's encrypt, which makes, uh, certificates easy and automated to get and to secure your connection to a website. [02:19.120 --> 02:20.980] Um, thank you. [02:21.980 --> 02:22.660] Yeah. [02:23.100 --> 02:42.260] Um, we also developed browser plugins and browser, well, I should say browser add-ons such as HTTPS everywhere, which, uh, was a project that I led from 2015, 2018, uh, and privacy badger, which is a browser add-on, um, that, um, protects your connection from online trackers. [02:49.790 --> 02:55.750] Um, so, uh, so yeah, um, just, uh, who am I, uh, I'm Bill Buddington. [02:56.110 --> 02:59.050] Um, I joined EFF, um, over a decade ago. [02:59.330 --> 03:01.490] Uh, it's crazy to think about it. [03:01.650 --> 03:04.810] Um, but yeah, over a decade ago, the Internet was a very different place. [03:05.110 --> 03:09.290] Um, but, um, yeah, I started working on our action center. [03:09.290 --> 03:17.730] If you go to act.eff.org and then I transitioned over to our, what was then called tech projects team, um, doing HTTPS everywhere. [03:18.070 --> 03:21.550] Also, I'm the lead of what used to be called panoptic click. [03:21.810 --> 03:23.110] Now it's called cover your tracks. [03:23.110 --> 03:40.650] So if you go to cover your tracks.eff.org, um, it'll basically do a test of your browser and see how, uh, fingerprintable or how much unique characteristics, um, that your browser leaves and how that can be used as a surrogate for cookies. [03:40.850 --> 03:44.590] Um, so without cookies, you can be tracked via this method. [03:44.910 --> 03:48.050] Um, so we did that as a proof of concept in 2010. [03:48.050 --> 03:54.690] Uh, and, um, and that's been a project that we, that I've been maintaining and we've been, uh, supporting, uh, ever since. [03:55.370 --> 03:57.850] So, so that's kind of my history at EFF. [03:58.170 --> 04:02.810] I'm right now I'm more kind of investigating, uh, instances of malware. [04:03.090 --> 04:06.670] You can attend, attend my talk tomorrow at three o'clock in the little theater. [04:06.970 --> 04:14.670] Uh, and that's going to be on bad box, which is a piece of malware that is included in Android set top boxes. [04:14.670 --> 04:16.850] And it's, uh, constitutes a supply chain attack. [04:17.050 --> 04:19.050] Uh, and so, yeah. [04:19.270 --> 04:21.950] Um, and with that, I'll, uh, hand it over to Hannah. [04:27.240 --> 04:27.880] Hi, everyone. [04:28.380 --> 04:30.460] Um, welcome to this talk. [04:30.700 --> 04:31.980] My name is Hannah. [04:32.540 --> 04:38.420] Uh, I am a lawyer with EFF, but nothing I say here should be construed as legal advice. [04:39.300 --> 04:43.020] Um, I work on lots of different issues. [04:43.020 --> 04:46.420] I started out as a public defender, uh, in my legal career. [04:46.420 --> 04:49.280] And then I started working for EFF over four years ago. [04:49.760 --> 04:59.520] Um, at EFF, I work on cybersecurity and privacy and police tech issues. [04:59.520 --> 05:09.460] Which is to say I challenge a lot of bad technology that the government uses that isn't reliable, is prone to error or security issues, violates our privacy rights. [05:09.460 --> 05:14.720] Um, I'm also part of the coders rights team, which Kara is also on. [05:14.860 --> 05:28.320] And what we do is provide free counseling to security researchers and other folks who maybe they found a vulnerability or maybe they're thinking about investigating into a vulnerability and they want to do that safely or at least do it with full knowledge of the risks and what kind of actions are more risky, less risky, and what kind of legal or other types of trouble they may get in. [05:37.080 --> 05:42.880] And we offer that type of counseling, which you normally have to pay a lot of money for, for a law firm. [05:43.000 --> 05:57.240] Uh, we offer that for free for the security research community because we really believe in the importance of this community and the good work that we do because we think finding vulnerabilities is actually makes things more secure for everyone. [06:03.200 --> 06:09.160] Um, and lastly, a huge chunk of my work is also anti-surveillance work and, uh, forensic... [06:09.160 --> 06:10.840] and challenges to forensic technology. [06:10.840 --> 06:31.540] For example, face recognition, ALPRs, um, DNA, probabilistic DNA software programs, um, other types of really unreliable technology like ShotSpot are being used by police as a basis to take action when they are literally, uh, not working correctly, as is claimed by the developers. [06:34.420 --> 06:36.740] Um, and with that, I'll pass it on to Beryl. [06:38.540 --> 06:39.640] Beryl Lipton Hey, everyone. [06:39.860 --> 06:41.020] My name is Beryl Lipton. [06:41.200 --> 06:45.120] I am an investigative researcher with the Electronic Frontier Foundation. [06:45.400 --> 07:01.820] A lot of my work is focused on uncovering different types of police surveillance that, um, we may not already know about in the public and also tracking existing types of police surveillance like cell site simulators, automated license plate readers, uses of face recognition, and trying to understand, um, who is using what types of technologies and how and sort of what policies they have around those uses. [07:12.600 --> 07:20.020] If you are not familiar with it, you should check out the Atlas of Surveillance, which is one of the big product, uh, projects that I support. [07:20.520 --> 07:32.760] And a lot of my work is based on public records requests and, um, helping other people, uh, use public records requests in government accountability and transparency efforts. [07:33.060 --> 07:41.260] So if you have any questions about, uh, uh, FOI laws in all sorts of places, uh, please feel free to find me. [07:41.620 --> 07:44.520] I also spend a fair amount of time talking to classrooms. [07:44.520 --> 07:55.840] So if you happen to be an educator who is interested in hearing more about specific uses of police surveillance technology, or even having your class contribute to the Atlas of Surveillance, I'd also encourage you to get in touch. [07:59.230 --> 08:10.410] Hi, I'm Cara Gagliano, uh, Hannah kind of previewed for me who I am, uh, also an attorney at EFF and on the Coders Rights Project with Hannah. [08:11.010 --> 08:20.650] Um, a lot of my other work focuses on the intersection between copyright and trademark with free expression issues. [08:20.910 --> 08:42.790] Uh, so I'm on our team representing the Internet Archive, uh, who's been sued by a number of the biggest publishers, uh, in the country and the world, uh, for making digital copies of books that they and partner libraries already own in physical form and lending them one person at a time on the Internet. [08:47.650 --> 08:54.970] Uh, I also do a little, a little government transparency work, uh, some free speech work, some privacy work. [08:55.070 --> 08:55.510] I dabble. [08:56.210 --> 09:18.170] Um, and a lot of that has come together lately for me focusing on work around technologies used in carceral institutions, so prisons and jails, uh, currently leading a lawsuit against San Mateo County in California over their policy of forbidding physical mail from entering their jails. [09:21.470 --> 09:31.210] Uh, if you want to write to someone incarcerated in San Mateo, you have to send your mail to a private company that contracts with the county. [09:31.210 --> 09:48.130] They will scan your mail, shred your mail, whether that's a letter from your mom or a crayon drawing from your daughter goes in the shredder, and the digital copy stays in their database indefinitely. [09:48.570 --> 09:56.830] Um, their position is basically they can do whatever they want with it because you have, according to them, no expectation of privacy in jail. [09:57.490 --> 09:59.830] Uh, so we take issue with that. [10:00.150 --> 10:07.090] Happy to talk more about it later, but want to get onto the reason that you all came to this, uh, which is your questions. [10:07.990 --> 10:12.390] So I think we're, we're gonna ask people to come up to these two microphones. [10:12.790 --> 10:15.270] And there's another microphone on that side, as well. [10:18.340 --> 10:22.040] Hi, uh, I have a question about, uh, Stingray technology. [10:22.580 --> 10:33.320] Apparently it's possible for a private company to develop technology that could be a man in the middle, pretending to be a cell phone tower, and then just harvest all the cell phone identities that have been around them, marketed to police [10:33.320 --> 10:40.480] departments who bought it and implemented it without it ever going through any review about whether that violated people's rights or whether it was legal or something. [10:40.480 --> 10:50.420] Is it true that corporations can just build technologies, sell them to police departments, and then some organization like the EFF has to go track them down and then bring them to court? [10:50.600 --> 10:58.200] Is that, is that the case that those kinds of technologies can just get built independently and marketed to police departments without anyone noticing that? [10:58.200 --> 11:18.300] Yeah, I think one of the issues that exists is that, except for specific regulations on what is considered like weapons and technology like that, there is no formal vetting system or even review system for the technology that is employed by police departments and law enforcement agencies. [11:20.340 --> 11:33.140] So any private entity can develop a tool and market it to any law enforcement agency and they can begin using it unless there are specific local ordinances. [11:33.420 --> 11:42.780] For example, some CCOPs ones may have limits on funding and therefore they have a review board that might be able to review use of these. [11:42.780 --> 11:47.480] If those types of regulations are not in place, then it is... then what you say is true. [11:47.480 --> 11:51.460] And that does happen a lot around the country, unfortunately. [11:53.520 --> 11:54.140] And... [11:54.140 --> 12:03.680] They are being used in a lot of places and without challenge to the legality of the use. [12:03.840 --> 12:16.840] I think the type of issue, the type of arguments we've made about steam rain has to do with certain specific types of uses that we argue in those circumstances violate, for example, a reasonable expectation of privacy. [12:17.320 --> 12:28.500] We would love to see a lot of local... you know, all localities adopt ordinances that prevent the use of steam rays, but unfortunately that is just not the case right now. [12:28.580 --> 12:33.620] So they are legal unless there's a specific, you know, ordinance against it. [12:36.260 --> 12:46.040] I would also add, right, this marketing issue is one of the big problems that we're facing with local law enforcement and just in law enforcement acquisition of technology in general. [12:46.520 --> 13:01.200] One of the places where we have some leverage in terms of accountability tends to be procurement processes, but without some of these ordinances or without some other clear path by which law enforcement is required to disclose that they are looking to purchase this sort of thing. [13:02.400 --> 13:03.680] It is difficult to know. [13:03.820 --> 13:13.400] And unfortunately, what we're seeing in some situations with the consolidation of the surveillance market is that there are sometimes companies, too, that are either... [13:13.400 --> 13:23.220] Rather than going through the procurement process again, they are just amending existing agreements in order to expand the types of surveillance that exist. [13:24.800 --> 13:27.940] So... and I want to make a point about the marketing. [13:28.320 --> 13:36.420] Law enforcement is not necessarily vetting or coming up with their own audit mechanisms for how accurate some of these marketing claims are. [13:36.560 --> 13:53.900] And so with something like ShotSpotter, ShotSpotter will tell you that it has a 97% accuracy rate, but they build that rate on a 100% baseline, and then they deduct based on whether there are proactive reports from police departments letting them know that actually something was miscategorized as a gunshot. [13:57.760 --> 14:11.460] And now there are lots of reports coming out based on, you know, the records around responses to these gunshot notifications that are demonstrating that, you know, New York City just did a report in the auditor's office that basically suggested that [14:11.460 --> 14:20.660] 87% of those gunshot notifications were miscategorized and did not associate with any sort of actual gunshot. [14:20.920 --> 14:29.240] So I think marketing and the way that police departments fall into that trap is one of the big things that we have to be on top of. [14:30.800 --> 14:36.120] Just to add from a technical level... [14:36.960 --> 14:38.260] Can you hear me now? [14:39.320 --> 14:39.520] No? [14:39.520 --> 14:40.580] No, that microphone's there. [14:41.920 --> 15:01.680] From a technical level, I'm not a Stingray expert, but one of the things that Stingrays will do, also called IMSI Catchers, will do is they'll downgrade your connection to 2G in order to interrupt the flow and to basically kick you onto their private cell network. [15:03.400 --> 15:21.980] So a lot of the smartphone operating system, you know, like, for instance, if you have lockdown mode on in iOS, will disallow or give you an option, at least, to not use a 2G connection and to be protected in that way. [15:22.620 --> 15:26.660] And Android has a similar setting that they just recently introduced. [15:27.060 --> 15:36.820] So if you are concerned about having your cellular connections intercepted via Stingrays, then that will be a setting that you want to pay attention to. [15:42.890 --> 15:43.990] Did you point at me? [15:45.630 --> 15:46.530] Yeah, sure. [15:46.530 --> 15:47.130] Okay. [15:47.270 --> 16:07.290] I'm concerned about license plate readers in private hands, especially in states adjacent to places where there are anti-abortion bounty hunter laws, which allow somebody to sue for a period of up to five years after they believe somebody's assisted in an abortion. [16:07.950 --> 16:18.430] There's nothing that keeps somebody from just setting up ALPRs adjacent to every abortion clinic in an adjoining state and recording that forever. [16:18.970 --> 16:21.030] So what do we do about that? [16:21.210 --> 16:24.530] What do we do about license plate readers in general in private hands? [16:24.690 --> 16:26.950] Because you're required to display your plate. [16:26.950 --> 16:28.850] You have no option as a citizen. [16:32.060 --> 16:38.040] I think this is a really important shift in surveillance technology, right? [16:38.120 --> 16:53.620] In the past 10 years, we can see a huge shift in technology being in the hands of state, to technologies being... surveillance technologies being used by private individuals, and they then submit that information to the government, and the government can, you know, or law enforcement agencies can do with that what they will. [16:57.100 --> 17:09.380] That is a much harder fight in a lot of ways than fighting against straight-up government surveillance, and that is because our constitutional rights protect us from the government, but not from private individuals. [17:09.620 --> 17:25.310] There are still ways that we are exploring how, for example, I think in the reproductive justice area, there are states now are passing specific ordinances trying to protect the privacy of people who are seeking abortion services. [17:25.310 --> 17:33.550] California has a law like that, specifically about ALPR data, but it doesn't regulate private use of the ALPR data. [17:33.750 --> 17:44.550] It just regulates the government's use and whether they can provide that information to law enforcement agencies from outside of California, from states that do ban abortion. [17:44.550 --> 17:51.050] This is definitely a ripe terrain for litigation. [17:51.590 --> 17:55.130] But, you know, litigation takes a long time. [17:55.510 --> 18:00.470] In those circumstances, the fight for it, I think, is close to what California is doing. [18:00.650 --> 18:19.750] It's doing state or local regulations advocating for laws and regulations that will protect that kind of information from being used or from being...so if we say, like, law enforcement agencies is not allowed to use this information, even if private individuals have that information and want to give it to law enforcement, they will not be able to use it. [18:24.030 --> 18:33.870] But it is definitely the proliferation of private surveillance tools and creating a network of that. [18:33.870 --> 18:39.170] That's a fight that we're engaged in and is a very difficult one, for sure. [18:42.390 --> 18:52.870] Private surveillance of peer-to-peer traffic by systems which are truly law enforcement systems, but they claim to be private systems. [18:52.870 --> 18:58.150] So their methods and techniques are not subject to inspection by independent parties. [18:58.550 --> 19:04.650] There's no Brady obligation to disclose exculpatory information they might have. [19:04.650 --> 19:08.210] And so I don't know what we're going to do about that either. [19:08.510 --> 19:11.750] There are numerous examples of those. [19:11.870 --> 19:13.870] Like, CPS is the best example. [19:14.470 --> 19:15.650] Operated by this broker. [19:16.410 --> 19:17.670] Used to be called TLO. [19:18.710 --> 19:21.230] Yeah, I think it's also hard to... [19:21.230 --> 19:25.850] That's another area that is true and it's expanding, and there is, like, mercenary...right? [19:25.950 --> 19:39.330] Like, almost like mercenary police forces or quasi-law enforcement forces that brand themselves as more militarized forms of, like, a neighborhood watch, essentially. [19:39.590 --> 19:39.690] Right? [19:39.910 --> 19:42.510] And those, again, are areas. [19:42.510 --> 19:49.470] We are seeing this, you know, conflagration of the state surveillance system and these private actors. [19:50.610 --> 19:54.130] We...that's another area, again, that regulations... [19:54.830 --> 20:09.270] Like, what we need to do as these new types of threats to our privacy develops is to come up with new laws to decide where we want to put the power and who gets to share what information with whom and who gets to collect what kind of information. [20:11.870 --> 20:13.170] Why don't we bounce it over here? [20:13.390 --> 20:13.890] How's it going? [20:14.470 --> 20:16.770] Um, I'm an automotive enthusiast. [20:17.010 --> 20:22.650] Um, and in May, Jalopnik shared a story from Sherwood News. [20:23.230 --> 20:25.970] Um, the story was, uh, the... [20:25.970 --> 20:28.910] the person who wrote the story from Sherwood News had just bought a Honda Accord. [20:29.530 --> 20:35.070] And going through the infotainment, there's an opt-out to track all of your data. [20:35.430 --> 20:37.410] And they could not opt out. [20:37.410 --> 20:40.350] And they contacted Honda. [20:40.550 --> 20:43.430] They contacted, uh, the dealership. [20:43.590 --> 20:48.370] It comes to find out that there are about five states that will allow you to opt out. [20:48.730 --> 20:51.310] So, I wrote my congresspeople. [20:51.610 --> 20:52.490] Um, I'm from Virginia. [20:52.850 --> 20:58.450] I wrote, um, Tim McCain, uh, Mark Warner, and then Jerry Connolly is my local. [20:59.050 --> 21:03.150] Jerry Connolly replied with, he thought I needed mortgage help. [21:03.350 --> 21:05.650] You know, this is all from their Internet website. [21:05.850 --> 21:07.230] You know, type in what I thought was best. [21:07.410 --> 21:12.450] Mark Warner replied with, you know, this is something that's important, but there's nothing I can do about it. [21:12.650 --> 21:14.890] Um, and I haven't heard from Tim Canyon. [21:15.650 --> 21:24.610] So, other than not buying a Honda or any car that will track, is there anything that I can do other than vote for people that... [21:24.610 --> 21:26.750] that are like-minded like me? [21:27.130 --> 21:29.930] Is there, is there anything we can do to stop that kind of track? [21:30.510 --> 21:37.990] Uh, I think one, this, this immediately makes me think of our right to repair work. [21:38.190 --> 21:44.750] Uh, and actually the auto context is where we've made some of the most gains. [21:44.750 --> 21:57.010] Um, you know, depending on what your particular technical skill set is, you might be able to make use of the exemptions we've gotten. [21:57.310 --> 22:02.190] Um, and I should, I should back up a little for people not steeped in this world. [22:02.190 --> 22:10.790] Uh, there is a law, it's part of the Digital Millennium Copyright Act, but it's separate from copyright infringement law. [22:11.010 --> 22:28.050] It is called Section 1201, and it says whether or not you infringe copyright, or that's actually debatable, but majority have been saying it applies whether or not you infringe copyright. [22:28.050 --> 22:39.730] You cannot circumvent a technical protection measure, so something like DRM, that is supposed to block access to a copyrighted work. [22:39.910 --> 22:45.430] And software code is a copyrighted work most of the time. [22:45.610 --> 22:57.350] Um, so we have gained exemptions to that, particularly for auto repair and certain kinds of modification. [22:58.110 --> 23:15.050] Um, I think the infotainment centers have been kind of the one where they've carved out and said, well, that it seems too likely that you're, like, gonna use your car to pirate movies is, I guess, what they're thinking. [23:15.050 --> 23:27.230] I mean, I'm sure some enterprising hackers here could definitely do it, but I don't think it's really a reason to say that no one can do it at all. [23:27.230 --> 23:46.150] Um, but the point is that this law where we actually have a constitutional challenge to it, it really gets in the way of being able to do things like modify the firmware so it doesn't track you. [23:46.150 --> 23:55.570] Um, and that's, that's kind of one of the arguments that's gotten gains in terms of regulatory exceptions to it. [23:56.130 --> 23:58.530] Uh, but we're still working on that. [23:58.690 --> 23:59.470] So don't buy a Honda. [24:00.850 --> 24:02.870] Farmers are having the same problem with John Deere, right? [24:02.870 --> 24:03.550] Yeah, exactly. [24:04.010 --> 24:10.430] And I think Massachusetts passed a law where right to repair, so I can fix my car, I can break open my iPhone, where I should be. [24:11.230 --> 24:12.010] Thanks for your time. [24:12.130 --> 24:12.710] I appreciate it. [24:13.150 --> 24:18.490] Just one follow up on that too, is that, um, you know, I'm, I'm renting a car while I'm out here. [24:18.730 --> 24:22.350] Uh, and, uh, I don't have it connected to CarPlay. [24:22.910 --> 24:27.790] Um, just because I don't want another company to have that data. [24:28.030 --> 24:31.390] I have my car at home that has that data already. [24:31.610 --> 24:37.610] And just kind of game like, uh, yeah, thinking tactically about who have I already shared this with? [24:37.610 --> 24:47.510] Um, maybe it's okay if I already shared it with that manufacturer, but, but they might, you know, specific, depending on the specific model of car might, uh, share different types of data. [24:47.890 --> 25:00.330] So privacy for cars is a great organization that, uh, you know, really kind of gives a guide on how to disable this sharing of data where possible. [25:01.050 --> 25:03.070] And, and we're working with them a bit. [25:06.340 --> 25:07.160] Yeah, go ahead. [25:07.800 --> 25:08.320] Yeah. [25:08.620 --> 25:23.480] Um, I just like to start off on a light note and say, I pay $10 a month for the EFF because if I want to expect a media ecosystem that isn't filled with rage and smoke and mirrors, then I need to defend, I need to send my money to the EFF. [25:24.280 --> 25:24.840] Yeah. [25:27.500 --> 25:32.300] Um, so, and I'll continue with the more challenging questions. [25:32.300 --> 25:37.200] And I don't feel like it's unfair to have four people have all of the world's questions thrown at them. [25:37.200 --> 25:42.880] Um, but I've been following the EFF since the nineties and or late two thousands. [25:43.200 --> 25:50.320] And, um, I would, when the Internet was a frontier and, uh, the Internet's no longer a frontier. [25:50.320 --> 26:02.080] It is in our pockets and it's so much, not a frontier that we need it, that it actually stands in, in the way of each other before that we can actually communicate with each other directly. [26:02.080 --> 26:11.880] Effectively, our, our, uh, cultural associations have been routed through, um, servers running algorithms about what type of person we are and how we should feel and think about things. [26:12.380 --> 26:12.540] Hmm. [26:13.480 --> 26:19.820] And so, um, and the data crumbs, um, have been just scattered and then scattering for decades now. [26:20.060 --> 26:25.720] Um, so that, uh, data scientists can build a very accurate picture of who you are and where you might be going. [26:26.440 --> 26:30.860] Um, and also, um, you know, if that wasn't bad enough, uh, you know, Roe v. [26:30.980 --> 26:31.180] Wade. [26:31.180 --> 26:40.220] Um, the Supreme Court's, uh, the Supreme Court disagreed with the, with the implied right that privacy was, and was, was in the Constitution. [26:40.740 --> 26:45.200] Um, which is the, which is the cornerstone of, I think, what we're trying to do here. [26:45.880 --> 26:49.620] Um, does this seem like hopeless? [26:49.620 --> 26:52.720] Um, or does, I mean, is it the Fediverse? [26:53.100 --> 27:03.780] Like, do we, I mean, and listen, I'll use UNIX, I'll use Linux, I'll try, I'll set up a mesh net, I'll, you know, be a, you know, I'll be that cheerleader that's obnoxious to all my friends. [27:03.780 --> 27:08.480] Um, I mean, it's, uh, you know, decorate, you know, buy the stickers. [27:08.660 --> 27:09.380] Okay, cool, cool, cool. [27:09.700 --> 27:11.160] That's what your laptop looks like. [27:11.300 --> 27:11.900] Dress all black. [27:12.360 --> 27:24.160] Um, I, uh, I guess I'm just wondering, um, in your, in your perspective, where does the future go with, when big data, um, needs, uh, constant digital crumbs? [27:24.160 --> 27:30.220] And, uh, is there, and are we entitled to, but maybe are we entitled to some remuneration by providing those crumbs? [27:33.210 --> 27:42.390] Uh, just, uh, um, so, uh, a friend of mine, a former EFFer, uh, is developing something called semifemoral. [27:42.850 --> 27:46.450] Um, uh, Micah is actually giving a talk at five today. [27:46.790 --> 27:56.270] Um, and so that's a cool project, which will go and manually delete some of the, these bits of information from, uh, big, uh, third parties. [27:56.890 --> 27:58.370] Um, so that's one solution. [27:58.370 --> 28:10.510] I think, um, unfortunately, a lot of the data broker kind of, uh, part of this equation is, you know, takes so much manual labor to get it done that, um, it is worth it. [28:10.630 --> 28:17.330] And I subscribed to a, um, a data broker deletion service called delete me. [28:17.590 --> 28:25.510] Um, so that's kind of one thing, one way that I, that you can get your data, uh, scrubbed, I guess, from, from the Internet. [28:25.530 --> 28:38.290] Uh, in those various ways, but, but yes, the more kind of structural, uh, changes, I think that there are some promising, you know, um, those are promising services out there. [28:38.290 --> 28:49.890] Where we have, you know, the Fediverse, and we have some of these, you know, kind of more, more, uh, democratized alternatives to the big platforms that are out there. [28:49.890 --> 28:52.370] And, um, um, I hope those continue to grow. [28:52.630 --> 28:56.010] Um, you know, blue sky is, is also one of those, so. [28:57.110 --> 29:12.250] I just want to add that you pointed out the issue with the federal government, um, both in its inability to pass legislation that can protect us from some of the harms that you identify, and also in the Supreme Court deciding there is no privacy right in the Constitution. [29:13.770 --> 29:27.590] There are privacy rights, however, specifically enumerated in state constitutions, and this goes back to a former question, I believe you mentioning, talking to your, uh, federal, your United States senators and representatives. [29:27.590 --> 29:38.590] Um, California has very robust privacy, uh, protections because we passed state legislation, the state constitution enumerates a privacy right. [29:38.890 --> 29:49.950] There are 10 states, if I remember off the top of my head, that have privacy specifically enumerated in their state constitutions, and this does demonstrate a shift in our litigation policy, too. [29:49.950 --> 30:00.990] We used to focus a lot more, almost, almost to the point of exclusively on federal cases, but we do that less now, and we explore a lot of state possibilities. [30:00.990 --> 30:04.850] Because if you get enough states, you get the big states to make certain decisions. [30:04.850 --> 30:19.530] I know that California's privacy rights, uh, regulations have had rippling effects where companies don't want to juggle two different things, so then they just comply with the privacy requirements of the California laws, and then that kind of just has a ripple effect for everyone else who also happens to use it but doesn't live in California. [30:23.670 --> 30:29.070] So that kind of thing, you know, um, can work on a more local level as well. [30:29.190 --> 30:35.750] And that is, that is a place where I do see more hope because we are seeing some of these laws getting passed. [30:39.920 --> 30:50.180] Speaking about, um, privacy and everything, uh, back in 2017, um, the United States government introduced a bill called the Lawful Access to Encrypted Data Act. [30:50.360 --> 30:57.560] And then, um, they had a kind of like a part of that split off called the Earn It Act, which was reintroduced, um, in 2023. [30:58.120 --> 31:04.520] And there seems like that there really hasn't been any movement in the House or the Senate on both of those laws. [31:04.520 --> 31:11.320] I was just wondering if, um, from the EFF's, uh, perspective, is, uh, no news good news? [31:11.320 --> 31:17.540] Or should we still be concerned that, um, the Earn It Act and the Laid Act would still possibly be passed into law? [31:19.260 --> 31:23.770] I think, in a sense, no news is good news, definitely. [31:23.770 --> 31:40.270] I know EFF, uh, has, has really been kind of at the forefront of opposing the Earn It Act, uh, especially after seeing kind of everything negative that we predicted about FOSTA-SESTA coming true. [31:40.270 --> 31:59.010] Um, so I think I, I'm channeling our, uh, legislative folks, uh, one in particular, India McKinney, because I think her position is that Earn It is probably not going to die. [31:59.010 --> 32:04.430] Like, like, it's just going to keep getting kind of re-upped. [32:04.810 --> 32:10.250] But we're, you know, relieved to see that there hasn't been movement on it lately. [32:11.230 --> 32:24.410] Um, but it's, it's the kind of thing that we, we tend to think, you know, eventually they're probably going to be getting more traction with some version of it. [32:24.410 --> 32:31.730] And so we have to do whatever we can to mobilize people, especially when they'll be most effective. [32:32.110 --> 32:40.510] Um, so I think that kind of goes into our activism strategy and why we might not be talking about Earn It as much right now. [32:40.790 --> 32:50.310] Because it's like, okay, we can focus on COSA, uh, for example, but it's, it's definitely something we're always monitoring. [32:55.440 --> 33:00.660] Uh, so my question is about the establishment of standing for lawsuits. [33:01.040 --> 33:10.160] Um, I had mentioned a table, uh, at the table where about a friend who believed she was being harassed by, uh, state police. [33:11.260 --> 33:19.640] And she was a cop and she would have the state police actually quote back to her things that were in her emails and text messages in meetings. [33:20.840 --> 33:30.200] Um, and she came to me to set up a honey pot, but frankly, I have no idea what I'd even be looking for with hacks. [33:30.200 --> 33:47.760] Like, I mean, people get hacked from all over the place nowadays, but like, how do you establish standing on something as murky as like an advanced persistent threat or, uh, network monitoring or somebody abusing a fusion center? [33:49.920 --> 33:57.260] I think, uh, it's a really good question about standing because as everyone knows, you need standing to bring cases in court. [33:57.660 --> 34:11.880] However, uh, I would say that the standing right now itself is very murky because there are certain cases where it has expanded a lot and there is standing, uh, that previously there might not have been. [34:11.880 --> 34:14.780] And there are cases where it shrunk. [34:14.980 --> 34:19.580] Now, do those decisions have to do with the substance of what the court was doing? [34:19.760 --> 34:26.580] So they were kind of going less on legal principle and more on how they feel about, ideologically feel about those issues, perhaps. [34:26.580 --> 34:31.280] But it is definitely a really, it's a really murky area, I think. [34:31.980 --> 34:51.480] Yeah, I mean, I can say I know one of the kind of perennial problems that we run into is standing in, especially the kinds of, uh, cases that you're talking about, um, was it was especially hard around mass surveillance, challenging mass surveillance programs. [34:51.960 --> 35:04.420] Because there, the government would say, you know, you can't prove that your specific, like, email was intercepted. [35:04.640 --> 35:15.480] Um, even though, you know, you, there have already been reports that, like, they're intercepting everyone's, like, they're collecting everyone's metadata. [35:15.480 --> 35:20.700] Uh, courts were saying, you know, that's not enough. [35:21.100 --> 35:29.480] So I think, and I know this doesn't exactly answer your question, but I think part of that you were saying, how do you establish standing? [35:29.880 --> 35:36.860] Part of it is showing that, you know, you have personally been affected. [35:36.860 --> 35:45.120] Um, and that you have part, one of the criterion is called a concrete and specific injury. [35:45.500 --> 35:54.180] Um, so the more that you can point to and, like, spell out in a complaint, you know, they did this to me. [35:55.480 --> 36:02.760] And this is an infringement of one of my rights, um, the more solid you're gonna be on standing. [36:03.920 --> 36:13.200] It's really helpful if there's ever evidence or, like, you lose a job, something bad happens as a result of those kinds of violations. [36:13.440 --> 36:17.980] Um, it's important when that kind of stuff happens to document it and keep records of that. [36:18.120 --> 36:19.440] Those are the type of things that can help. [36:20.200 --> 36:20.440] Right. [36:21.060 --> 36:24.580] That's because I overheard what standing, um, can you explain what standing is? [36:24.740 --> 36:24.960] Yes. [36:25.300 --> 36:30.100] Yeah, I was gonna say, I, I don't know, Hannah, if I agree, everyone knows you need standing to bring a lawsuit. [36:30.100 --> 36:30.140] Absolutely. [36:30.360 --> 36:41.040] So it's, uh, basically, especially in, in federal court tends to have, um, or at least sometimes has more stringent standards than states, certainly, than California. [36:41.700 --> 36:49.700] Um, so the law has developed to say that, you know, the courts have finite resources. [36:49.700 --> 36:56.540] They aren't here just to, like, answer your legal questions in the abstract. [36:57.380 --> 37:14.060] If a court is going to hear a case, you need to be able to show, like, that there has been or is going to be an injury with some degree of specificity and that it's an injury to you. [37:14.060 --> 37:32.540] Um, so the kind of justification for this is to make sure that the people who are bringing lawsuits are ones who actually have a stake and will actually be able to be the most effective litigants, um, you know, who will have the relevant information, um, and know the relevant factors. [37:37.420 --> 37:40.320] Basically, standing is who gets to sue. [37:40.580 --> 37:46.300] And, um, and like Cara already said, you need to have types of injuries or violations. [37:46.700 --> 37:51.600] If that sounds kind of confusing, this is a reason why it's a big topic on law school exam. [37:55.180 --> 37:55.740] Hi. [37:56.100 --> 37:57.480] A big fan first. [37:57.760 --> 37:59.840] A slightly different question for the panel. [37:59.840 --> 38:08.620] So, as career professionals in the kind of advocacy rights organization, how do you get people? [38:08.840 --> 38:13.680] And by people, I mean to say family members, friends, non-technical people. [38:13.960 --> 38:18.000] How do you get people to care about the things that the EFF fights for? [38:19.760 --> 38:22.380] Can you re- can, uh, you said that last part again? [38:22.740 --> 38:27.480] How do you get everyday people to care about the things that the EFF fights for? [38:29.420 --> 38:31.180] How do you get people to care about? [38:31.220 --> 38:32.680] How do you get people to care about the things we... [38:32.680 --> 38:32.740] Oh. [38:33.140 --> 38:33.620] Sorry. [38:34.160 --> 38:34.620] That's a problem. [38:34.640 --> 38:35.420] No, no problem. [38:36.200 --> 38:41.440] Yeah, I mean, one of the big things we do is education and blogging, right? [38:41.520 --> 38:59.140] Like, just putting what we've learned out there on our blog, uh, deep links, which will let everyone know, hey, look at this terrible, you know, um, instance of, uh, of, uh, you know, uh, bridging your rights that, that we've discovered. [38:59.400 --> 39:10.180] Um, and often kind of tying it to like, you know, for instance, the right to repair, uh, work that, that, you know, um, this is something that farmers want to do in middle America. [39:10.440 --> 39:29.320] You know, it's not necessarily typically, you know, the people that you'd think to be really behind EFF issues, but like bridging that gap and making sure that we, you know, kind of, uh, are representing a larger swath of, uh, of people, um, that, that, uh, might not, you know, be intuitively behind us. [39:33.700 --> 39:34.860] Uh, I think that's a big thing. [39:36.500 --> 39:44.960] So I'll say just on a more practical, like one-on-one personal level, one of the things I think about is, um, you know, I used to be a public defender. [39:45.320 --> 39:47.700] And of course that means defending people. [39:47.780 --> 39:55.280] And especially because I worked in appeals, people who had already been convicted of crimes and people will say, well, how can you defend these people who have committed all these crimes? [39:55.440 --> 39:56.940] Some of which are terrible crimes. [39:56.940 --> 40:15.440] And it's good to think about that for me in, in a different way, which is like, um, we, you know, like with privacy rights, I think, well, do I want the most private, intimate thing I've ever sent on email to be findable by someone else? [40:15.560 --> 40:22.480] Like, do I want my ex-partner to be able to see all the emails I'm sending to my current partner? [40:22.720 --> 40:24.280] This is why privacy is important. [40:24.460 --> 40:26.340] This is why data security is important. [40:26.340 --> 40:33.540] Um, you know, a lot of people say things like, well, I don't mind being surveilled by the government because I never do anything wrong. [40:33.840 --> 40:41.820] Um, but what about, but what about the government seeing all of your emails, all of your texts, all of the photos that you are taking? [40:41.880 --> 40:50.200] And let's not forget, there are studies that show a lot of times when people misuse their access to information. [40:50.200 --> 40:54.300] So this would be like folks who have access to all the collection of data. [40:54.300 --> 41:02.420] They often use it to track ex-partners and to harass them and to violate their privacy, to stalk them. [41:02.560 --> 41:03.600] That has happened before. [41:03.860 --> 41:06.980] And so that's the kind of thing I think about when I think about privacy. [41:06.980 --> 41:08.860] It's not have I done anything wrong. [41:09.080 --> 41:25.220] It's that, why should this information that is so sensitive and can be used so easily against me be out there accessible to human beings who have their own, their own flaws, their own problems, and might misuse that data? [41:25.220 --> 41:26.800] And that happens all the time. [41:27.860 --> 41:32.360] Yeah, I think that kind of personalization of the issue is a big thing. [41:32.560 --> 41:36.740] And, and trying to make people think about being in those shoes. [41:37.120 --> 41:50.400] Um, another, this jail mail case I was talking about, you know, it's, it's a particularly hard one because incarcerated people don't get a lot of sympathy in this country. [41:50.400 --> 41:57.660] Um, especially from the courts, uh, and legislators, but also people trying to support. [41:57.780 --> 42:06.500] But when you talk in terms of, you know, our specific client who used to get crayon drawings from his daughter, like that was a real example. [42:06.500 --> 42:26.520] And now she doesn't even like her mom says we're not going to bother sending those anymore because it's, it's just too demoralizing to know that her drawings are just getting shredded by some company and scanned into a database. [42:26.520 --> 42:36.820] Uh, so I think the more you can bring like really specific examples of, of human consequences, uh, the more traction you tend to get. [42:38.360 --> 42:44.860] Um, I, uh, my, uh, my question concerns airport security. [42:45.240 --> 42:58.820] Um, I travel a lot and consistently my boyfriend says, this seems like, uh, security theater or there's a theater that we were going abroad once and he was pulled aside, taken downstairs. [42:58.840 --> 43:02.160] And I think his hands were swabbed and we didn't know why that was. [43:02.160 --> 43:10.680] So concerning being flagged, but also just concerning how accurate is this and what are they doing? [43:11.020 --> 43:13.860] And what rights do we have to say no also? [43:17.680 --> 43:28.980] Um, definitely the, there, you know, right now, the, the way the legal landscape is, is that kind of treatment is legal. [43:28.980 --> 43:35.380] And, um, there are a lot of exceptions to that reasonable expectation of privacy. [43:35.540 --> 43:48.680] And really under the current analysis, what the government would say is, well, you don't have a reasonable expectation of privacy when you fly because of all the, you know, um, interests that the government has in security and whatever. [43:48.900 --> 43:53.680] And I think that goes to the other part of your question, which is, well, how reliable is this technology? [43:53.680 --> 43:55.400] I don't know that technology very well. [43:55.520 --> 43:56.020] Do you, Bill? [43:56.640 --> 43:57.040] Or do you? [43:57.620 --> 44:08.960] So, uh, in 2018, uh, myself and my, uh, co-worker, Kurt Opsall, uh, gave a talk at the HOPE that year. [44:09.180 --> 44:14.940] And it was about, um, kind of, uh, protecting your data when crossing the border in the age of Trump. [44:14.940 --> 44:23.380] Um, so, uh, I think that data is still technologically relevant. [44:23.640 --> 44:34.260] And, um, we have a border, uh, guide as well, um, that you can refer to, to kind of, you know, follow the steps to protect your data when crossing borders. [44:34.260 --> 44:39.500] Um, I can go into more details, but, uh, I think that, as we continue the questions. [44:40.260 --> 44:40.580] Yeah, I see. [44:40.960 --> 44:41.660] Yeah, five minutes. [44:41.740 --> 44:42.440] Five minutes left. [44:43.720 --> 44:44.280] Oh. [44:44.440 --> 44:44.960] Oh, sorry. [44:45.400 --> 44:47.080] Uh, there's a question from the Internet. [44:47.640 --> 44:48.140] Uh, from... [44:48.140 --> 44:55.220] Alan Q asks, is the EFF doing work around intelligent traffic systems and the potential privacy issues with vehicle tracking? [44:58.420 --> 45:05.920] I think the question was whether EFF has done work around intelligent driving systems and, like, driverless cars. [45:05.920 --> 45:15.300] and such, I imagine, um, I know you're reading it from someone submitted online, uh, and privacy concerns around vehicle tracking? [45:15.500 --> 45:17.880] Vehicle tracking with intelligent traffic systems. [45:18.240 --> 45:21.100] Like cameras at intersections, or... [45:21.100 --> 45:21.600] Oh, okay. [45:21.940 --> 45:22.540] Wait, thank you. [45:22.820 --> 45:23.400] Smart City stuff? [45:24.740 --> 45:25.320] Yeah. [45:25.900 --> 45:26.220] Done? [45:26.460 --> 45:27.360] Well, let's go with that. [45:27.560 --> 45:28.200] No, go ahead. [45:28.740 --> 45:33.090] If that's in reference to, like, Smart City technologies, we have done some... [45:33.570 --> 45:42.610] some very disheartening litigation on it, but also, um, I think, uh, I think you mentioned intelligence traffic system? [45:43.350 --> 45:44.550] Intelligent traffic system. [45:44.770 --> 45:44.970] Yeah. [45:45.310 --> 45:49.870] So, there are, like, uh, this idea, was it Twin City, right? [45:49.930 --> 45:55.350] Like, where you basically have, like, an almost complete digital model of the traffic and the way the city works. [45:55.350 --> 46:04.950] And if you integrate all the, like, technologies with each other, then in theory you can use that to, like, better do traffic patterns and prevent, like, traffic jams, which everyone hates, right? [46:05.150 --> 46:18.170] But, uh, but in fact, what it is being used for is, like, a collection of location data, which we think is one of the really dangerous parts of, um, of the surveillance system. [46:18.170 --> 46:25.450] As we know, uh, having someone's location data and their pattern of travel is...can tell you a lot about their lives. [46:25.610 --> 46:32.750] It can tell you that they are going from home to work to a reproductive services provider and then going home, right? [46:32.890 --> 46:41.990] And that kind of data, especially in this day and age, can be very, um, harmful for law enforcement to use against individuals. [46:41.990 --> 46:58.110] Uh, we've done a lot of work on those kind of things and on some of the integration stuff of, um, using trackers on, like, micromobility vehicles and having that kind of information being provided historically and real-time to the Department of, uh, Transportation. [46:59.670 --> 47:00.630] Like scooters. [47:01.530 --> 47:02.590] Yeah, like scooters. [47:02.730 --> 47:03.310] Micromobility. [47:03.450 --> 47:06.450] Yeah, like scooters or those electric bikes you can rent. [47:07.370 --> 47:09.870] I think about intelligent traffic systems, too. [47:10.050 --> 47:20.190] I think of it as sort of one of the ways that government is able to acclimate individuals to the idea that they're, you know, they're going to be surveilled and this is actually going to be convenient for them. [47:20.370 --> 47:32.770] We think about EasyPass as sort of an earlier automated license plate reader system, um, or, you know, the location tracking, which, um, is happening on almost all of our cell phones at this point. [47:32.770 --> 47:40.830] A lot of the ways that government was able to acquire that data initially had to do with trying to, uh, make more efficient the traffic systems. [47:40.830 --> 47:49.190] And I come from a journalism background and often, you know, if you're trying to think about how to make something interesting, just generally you're thinking about how does it affect the public's commute? [47:49.410 --> 47:50.590] Because that is what they care about. [47:50.770 --> 47:58.270] And so I think surveillance has really been able to ramp up, excuse me, because it's been able to be used in these sorts of ways. [47:58.270 --> 48:02.250] Um, sort of more generally in outdoor public space. [48:02.250 --> 48:11.650] We are also seeing a lot more, um, as Hannah alluded to, sort of, um, uh, more of a combination of the different data streams, right? [48:11.810 --> 48:14.290] So we're seeing cameras at intersections. [48:14.290 --> 48:15.910] They're grabbing our license plates. [48:16.070 --> 48:17.690] We have cameras that are grabbing our faces. [48:17.690 --> 48:21.350] We have real-time access from police into those systems. [48:21.350 --> 48:25.870] And then those are being fed into, um, you know, real-time crime centers. [48:26.050 --> 48:34.210] And this is all stuff that is happening when all of those people who are just commuting have had nothing to do with any sort of criminal activity. [48:34.210 --> 48:37.890] And all of that data is just being held and stored for a really long time. [48:38.670 --> 48:47.450] Um, and in terms of a sales point, I think smart cities, you know, um, people sort of like that as a sales point. [48:47.450 --> 48:54.410] And, um, but, uh, you know, a lot of that has to do less with, um, actual, right? [48:54.410 --> 49:08.410] Like effective public safety and more to do with commercial interests being, uh, sort of, uh, convinced that at a particular area is, um, a good place for them to set up and hold a, hold a business. [49:08.710 --> 49:20.290] So I'm glad that you brought that up, but because it feels like, um, traffic systems, um, help slide in a lot of different types of surveillance that people aren't really thinking about. [49:20.870 --> 49:23.950] Unfortunately, we're at the end of the, uh, time and that went really quickly. [49:24.250 --> 49:26.790] Uh, can people come and talk with EFF more? [49:27.470 --> 49:38.830] Yeah, I invite people, uh, to join us out in the lobby, um, or, uh, at some later point in time, if you want to come by the table, various of us will be there at, uh, certain points. [49:38.970 --> 49:44.050] But, um, can we take questions out in the lobby, um, a few minutes after this? [49:44.190 --> 49:49.710] We also have a speakeasy tonight at, uh, seven o'clock at the Stout at Grand Central. [49:49.710 --> 49:54.310] I know it's in Manhattan and a little bit of a truck, but we will be there hanging out, drinking beers and talking. [49:54.490 --> 49:56.770] At the Stout, say it again, at the Stout in Manhattan? [49:57.190 --> 50:00.110] Stout in Manhattan, uh, Grand Central Stout. [50:00.310 --> 50:01.270] Okay, excellent. [50:01.470 --> 50:02.070] Thank you so much. [50:02.190 --> 50:03.990] Thank our panel and...