[00:00.730 --> 00:07.030]  This is a discussion about data autonomy and counter-surveillance strategies for civil society.
[00:07.510 --> 00:12.730]  So I am a grassroots activist, political organizer.
[00:13.450 --> 00:20.210]  I do a lot of work with anti-repression, dealing with the repression of political activists.
[00:21.270 --> 00:27.510]  Over the years, I have helped to organize cop watch groups to expose policemen conduct.
[00:29.050 --> 00:33.970]  I've helped to develop bail funds, legal defense campaigns for activists.
[00:34.350 --> 00:44.030]  Because of this work, I am currently a defendant in this massive RICO prosecution that's being brought against cop city activists in Atlanta.
[00:44.850 --> 00:52.270]  So I have dealt a lot with the criminal justice system and its targeting of activists.
[00:52.270 --> 01:03.910]  And I've also worked professionally in information technology and done a lot of technical work adjacent to activist spaces.
[01:04.930 --> 01:27.630]  And because of this, I have spent a lot of time wrestling with this general big picture question of how can we leverage the potential of technology and especially data platforms systems while contending with the fact that we are in the most advanced and total data surveillance apparatus in history.
[01:29.610 --> 01:47.110]  And this talk is an overview of the research that we've been doing at Movement Infrastructure Research Network over the past couple of years to try to just give a sense of what we've been thinking about in terms of this question from the perspective of on-the-ground activists.
[01:48.330 --> 01:52.110]  So this talk is going to be kind of all over the place.
[01:52.230 --> 01:53.350]  It's going to be wide-ranging.
[01:54.630 --> 02:00.190]  Probably some of the things that we will hit will be things that you already know a lot about and some will be new.
[02:00.570 --> 02:03.030]  And hopefully that distribution will be different for each person.
[02:03.410 --> 02:06.950]  But we're going to do some high-level conceptual political framing.
[02:08.070 --> 02:10.490]  We're going to do a little, like, abstract threat modeling.
[02:11.150 --> 02:15.490]  We're going to do some complaining about existing infrastructural efforts.
[02:16.650 --> 02:19.490]  And then finally, we're going to get, like, really practical nuts and bolts.
[02:19.610 --> 02:23.170]  We're going to talk about, like, software and things that we could maybe try.
[02:25.090 --> 02:36.450]  So to start, I want to look at a very brief history of recent social movements and the efforts to control them, particularly through surveillance.
[02:37.190 --> 02:48.990]  And as we go through this history, I want to emphasize how the forces of social control and the forces of social liberation respond to each other in this kind of cat-and-mouse game.
[02:49.910 --> 02:52.350]  Okay, so surveillance, classic tactic.
[02:52.850 --> 02:57.550]  Probably the best-known example is COINTELPRO in the 60s and 70s.
[02:57.550 --> 03:17.930]  This was a massive program where the FBI, the CIA, other state agencies would infiltrate political organizations, install wiretaps on phones, surveil buildings, entrap activists, do false flag maneuvers, sell activists drugs, and then lock them up for it,
[03:18.310 --> 03:21.450]  get activists killed by each other.
[03:23.010 --> 03:32.950]  COINTELPRO was extremely effective in this era, and especially because of the kind of formal hierarchical nature of resistance groups in the 60s and 70s.
[03:33.430 --> 03:37.170]  Many movements were crushed for decades afterward.
[03:39.170 --> 03:43.330]  Fast forward to the 90s, and we've got the Internet is on the scene.
[03:43.570 --> 03:51.170]  And because of this, the networked communication, the collaboration technology that's afforded makes it much easier for dissident organizers.
[03:51.170 --> 03:56.710]  Even without centralized leadership or necessarily any structure at all.
[03:58.470 --> 04:02.630]  This picture is about TextMob, which is like...
[04:02.630 --> 04:05.130]  It's the OG group chat.
[04:05.530 --> 04:09.930]  You know, this is like the predecessor to what we saw in the previous talk.
[04:11.870 --> 04:23.170]  This was a software that allowed protestors in the early 2000s to send text messages that they could type into their cool, like, Nokia phone with the T9 keyboard.
[04:23.690 --> 04:28.250]  And rather than the message going to one person, it would go to a group of people.
[04:29.310 --> 04:37.930]  It's kind of like mind-blowing to think that this would be a novel concept, but at that time, it was a game-changer for political organizing.
[04:37.970 --> 04:47.130]  It would allow activists to orient each other very quickly about situations, you know, unfolding in the streets, to appear suddenly.
[04:47.390 --> 04:50.730]  And then even after they would get dispersed, they could reassemble very quickly.
[04:51.310 --> 04:57.990]  And again, even without the kind of centralized leadership that political organizers had depended on in previous eras.
[04:59.390 --> 05:12.510]  Following on this period, you know, for a while in the late 2000s, early 2010s, we started to see this kind of sense that social media tools were amplifying insurrectional energy all over the world.
[05:12.830 --> 05:17.230]  We had, like, the Arab Spring, the movement of the squares, Occupy.
[05:17.470 --> 05:20.390]  People were talking about shit like Twitter revolutions.
[05:21.330 --> 05:25.910]  They were talking about... the headlines would talk about Facebook as a democratizing force.
[05:25.910 --> 05:35.730]  People were doing stuff like crowdsourcing political manifestos in a Google Doc where anybody could type in whatever they thought should be in the manifesto.
[05:36.690 --> 05:39.830]  It was a super optimistic time.
[05:40.090 --> 05:44.510]  And even then, people knew that this was largely hype, right?
[05:44.910 --> 05:51.730]  But there was an element of truth to it because at that time, these platforms were largely ungoverned.
[05:51.830 --> 05:54.730]  And they were largely ungovernable in that era.
[05:56.070 --> 06:03.770]  But because of that, modern social control practices have adapted in response to that.
[06:04.230 --> 06:07.350]  So, like, this is how police see themselves now.
[06:07.970 --> 06:22.090]  They see themselves as having, like, a godlike view of all of the data streams across the entire Earth in some kind of anodyne, futuristic, like, space library, I guess.
[06:23.350 --> 06:28.770]  This... I'm not sure what the AI prompt was for building this image, but I would love to know.
[06:30.630 --> 06:41.390]  Okay, so... but in reality, what this means is that today, police work is focused on dominating the same networked data platforms that have been used for resistance in the past.
[06:41.710 --> 06:47.550]  It's based around extracting and processing the information from those platforms to use for surveillance.
[06:47.890 --> 06:57.830]  And that surveillance is used to generate intelligence, to map complex networks of activity, and then, finally, to deploy force against those people.
[06:58.370 --> 06:58.890]  Right?
[06:59.550 --> 07:00.630]  They're cops.
[07:00.770 --> 07:01.370]  They have guns.
[07:01.630 --> 07:05.490]  Even still in the AI future, they got guns.
[07:07.910 --> 07:13.370]  And this process, this mode of surveillance, is becoming more and more streamlined every year.
[07:13.370 --> 07:17.690]  This is an evolving partnership between law enforcement and big tech companies.
[07:18.210 --> 07:29.930]  At this point, this type of surveillance relationship has become so cozy that all the major tech companies have voluntarily built these special portals for law enforcement specifically.
[07:30.350 --> 07:33.670]  You can go to lers.google.com right now.
[07:34.050 --> 07:40.650]  And it will accept... you know, if you want to submit a data request claiming to be law enforcement, you can give it a shot.
[07:41.990 --> 07:47.930]  The entire purpose of these portals is to expedite the process of handing over our data to law enforcement.
[07:48.190 --> 07:59.310]  If you are an investigator, you just submit a request on one of these portals, you wait for a nice, tidy packet of well-formatted data provided directly to you with all the info that you could ask for.
[07:59.830 --> 08:03.670]  And it's all ready to be loaded into your data mining software.
[08:04.370 --> 08:08.270]  You make a request, you get the data back, you analyze it, you repeat.
[08:08.270 --> 08:13.870]  This is now the core loop of modern investigations against activists.
[08:15.730 --> 08:18.930]  And so, a kind of side point here.
[08:19.070 --> 08:20.450]  What do I mean by data mining?
[08:22.650 --> 08:27.250]  Let's watch... there's a brief video here that we can try to watch if the audio will work.
[08:27.250 --> 08:37.670]  This is an ad made by a company which sells software to police departments to do analysis of surveillance data that's produced by exactly these platforms.
[08:37.670 --> 08:40.070]  Let's see if this works.
[08:44.620 --> 08:46.480]  There's an ocean of information.
[08:47.660 --> 08:51.060]  Structured databases, SQL and NoSQL.
[08:53.780 --> 08:54.620]  Documents.
[08:57.800 --> 09:01.020]  Web, social media, images and movies.
[09:01.340 --> 09:04.200]  Do you want actionable intelligence from all of this?
[09:05.880 --> 09:09.260]  Would you like to extract new insights critical to your mission?
[09:10.380 --> 09:14.640]  Imagine a system that could understand everything with integrated reporting.
[09:24.500 --> 09:25.860]  It's called Syntelix.
[09:26.600 --> 09:29.480]  The secret weapon of high-performing analysts around the world.
[09:32.900 --> 09:35.720]  Syntelix imports data from any structured data source.
[09:36.140 --> 09:40.200]  Apply Syntelix ETL to extract, transform and load your structured data.
[09:40.200 --> 09:44.280]  The integrated harvester tool extracts from websites and social media.
[09:46.880 --> 09:52.860]  Information from social media is fused into the Syntelix network and reports are automatically generated.
[09:57.520 --> 10:02.140]  Syntelix extracts information from any document with over 1600 supported file types.
[10:05.460 --> 10:10.540]  Powerful AI means Syntelix extracts entities with an F1 over 97% in English.
[10:11.300 --> 10:13.220]  It also works with other languages.
[10:20.680 --> 10:23.880]  Obtain insight from any data source, regardless of origin.
[10:27.780 --> 10:31.340]  Text fields inside database records are also analysed and fused.
[10:35.500 --> 10:37.660]  Entities from documents are fused as well.
[10:43.420 --> 10:45.660]  Visualise information with the chart layout you want.
[10:50.890 --> 10:55.150]  Syntelix can generate complete analysis reports with timelines and geospatial information.
[10:58.450 --> 11:03.410]  Export your actionable intelligence as a Word document or a PowerPoint presentation.
[11:04.490 --> 11:07.420]  Switch to dark mode if you work in a sensitive information environment.
[11:08.130 --> 11:08.670]  It's your choice.
[11:11.530 --> 11:13.790]  Syntelix can connect to and analyse so much.
[11:14.050 --> 11:16.750]  The configuration options give complete flexibility.
[11:17.970 --> 11:21.410]  We created the app function to streamline complex tasks.
[11:22.710 --> 11:29.950]  Your organisation can create a complete Syntelix-based workflow in-house or outsource a solution to exactly your requirements.
[11:31.810 --> 11:36.970]  Globali is an exemplar app that continuously scans relevant online sources and social media.
[11:38.670 --> 11:41.550]  Complex workflows can be scheduled or triggered by an analyst.
[11:45.950 --> 11:51.410]  Once an app is created, the analyst needs far less training giving less time to actionable results.
[12:01.030 --> 12:06.870]  Syntelix is used worldwide by many sectors including military intelligence, law enforcement, corporate and government.
[12:07.870 --> 12:11.790]  It's easy to install anywhere from the cloud to secure 5S facilities.
[12:12.930 --> 12:14.970]  Get ahead of the adversaries worldwide.
[12:15.250 --> 12:17.470]  Gain actionable insights with Syntelix.
[12:17.670 --> 12:19.270]  The complete intelligence solution.
[12:21.190 --> 12:23.010]  Learn more at Syntelix.com.
[12:26.420 --> 12:28.640]  Many concerning things about this video.
[12:28.940 --> 12:31.140]  Most notably, of course, the soundtrack.
[12:34.660 --> 12:39.180]  But yeah, I mean, that video, I feel like, underscores a similar point that this graph does.
[12:39.640 --> 12:42.400]  Which is that the surveillance of data platforms...
[12:42.400 --> 12:45.580]  Surveillance through data platforms is growing and growing.
[12:45.760 --> 12:48.960]  It's becoming more of a niche industry of its own.
[12:49.280 --> 12:51.780]  It's becoming more prevalent, more popular with law enforcement.
[12:53.820 --> 12:58.740]  But, you know, thinking again about the evolution of, you know, this cat-and-mouse game.
[12:58.740 --> 13:03.240]  This trend alone is not a complete solution for social control.
[13:05.400 --> 13:17.060]  As the forces of social control lean harder and harder into surveillance, data mining as a policing mechanism, they become weaker at policing opaque populations.
[13:17.640 --> 13:20.560]  The FBI calls this the going dark problem.
[13:20.820 --> 13:28.800]  Basically, they've invested so heavily into surveillance that ungovernable networks become a blind spot for what is now the modern COINTELPRO.
[13:29.560 --> 13:40.040]  This quote here is former FBI Director James Comey basically whining that they can no longer wiretap every person in America.
[13:40.300 --> 13:49.160]  They say, We have the authority to intercept and access communications, but we often lack the technical ability to do so.
[13:50.700 --> 14:00.100]  So, you know, the takeaway for me from this is that when our data systems are ungovernable, it can help social movements resist control.
[14:00.800 --> 14:04.500]  But what is making data ungovernable here, right?
[14:04.580 --> 14:07.100]  What is the FBI so worried about?
[14:09.580 --> 14:20.280]  So, fast forward to 2013, this guy, Edward Snowden, triggered alarm about a new approach to social control, which had actually been happening for a long time.
[14:20.930 --> 14:25.120]  Pervasive systematic mass surveillance by the U.S. government.
[14:27.280 --> 14:31.410]  He leaked a whole bunch of documents, including this very famous slide.
[14:31.410 --> 14:45.230]  And this is a slide from an internal NSA deck that shows how the NSA has been exploiting the fact that all user data that Google holds is actually decrypted by Google internally.
[14:45.990 --> 14:46.590]  Right?
[14:46.670 --> 15:00.010]  So we can see on the left side, the data is encrypted by SSL, but then when it hits the Google front end, as the little note says, SSL added and removed here.
[15:00.010 --> 15:01.850]  Smiley face.
[15:03.390 --> 15:06.490]  That smiley face haunts InfoSec people.
[15:06.870 --> 15:09.950]  If you see that smiley face, it means you are fucked.
[15:11.690 --> 15:18.210]  So, when these revelations came out, engineers everywhere started freaking out.
[15:18.690 --> 15:23.470]  We started seeing a lot of charts like this, talking about end-to-end encryption.
[15:23.730 --> 15:25.190]  Zero-knowledge encryption, right?
[15:25.190 --> 15:30.850]  This became the prevalent solution to our understanding of widespread government surveillance.
[15:32.050 --> 15:49.990]  You know, so the notion here is, if the state is exploiting the fact that service providers are a choke point, an aggregator for all of the data that's being circulated between people, let's use cryptography to make sure that those servers, those data aggregators can't read shit,
[15:50.230 --> 15:55.270]  because the data is encrypted at the beginning of the transaction and it doesn't get decrypted until the end.
[15:55.570 --> 15:58.410]  So we started seeing services like this, right?
[15:58.770 --> 16:12.930]  SpiderOak was, I think, the first to coin this term zero-knowledge service, meaning a service which uses cryptography to guarantee that even though it's handling your data, it's basically mathematically unable to surveil you.
[16:14.050 --> 16:16.650]  I'm sure most of the people in the room know about these tools.
[16:16.850 --> 16:23.350]  These days, zero-knowledge tools are considered the state of the art for technical resistance to social control.
[16:23.590 --> 16:25.090]  These tools work.
[16:25.910 --> 16:27.710]  A lot of them are very widespread.
[16:28.150 --> 16:34.290]  And even though the authorities are constantly complaining about them and really hate them, they kind of seem unstoppable.
[16:36.170 --> 16:44.130]  But signs are emerging, which should make us worry that this is not the end of the story for the forces of social control.
[16:44.630 --> 16:56.210]  And so I want to talk about the limitations of zero-knowledge services, particularly from the perspective of activists and social movements which depend on these services for protection.
[16:57.130 --> 17:00.710]  First, let's think about some of the threats to zero-knowledge services.
[17:01.390 --> 17:02.430]  Technical threats.
[17:03.510 --> 17:05.010]  Yes, it is true.
[17:05.370 --> 17:16.210]  The NSA, for the bargain price of $10 million, paid RSA, which is a hugely respected encryption company, to put a back door in a cryptographic standard.
[17:16.410 --> 17:23.070]  This made it so that NSA knew how to break this particular type of encryption while nobody else was aware.
[17:23.070 --> 17:25.950]  And this came out from the Snowden leaks.
[17:26.310 --> 17:32.450]  And when we found out about it, you know, probably many of the people in this room freaked out.
[17:32.450 --> 17:35.810]  But for the most part, there was no, like, public scandal.
[17:36.050 --> 17:37.450]  There was no broad pushback.
[17:39.590 --> 17:46.530]  Attacks like this kind of make the whole premise of cryptography a little uncertain, right?
[17:46.530 --> 17:55.690]  If everybody's data is sitting in one big pot and it's protected by one cipher, you better hope it's not the next dual EC DRBG.
[17:58.170 --> 18:07.110]  Although, to be fair, the revelation about this particular attack has prompted a lot more vigilance of NIST crypto standards going forward.
[18:07.870 --> 18:12.190]  There's good reason to think that it would be a lot harder to do this kind of attack in the future.
[18:13.290 --> 18:15.270]  Let's talk about legislative attacks.
[18:16.390 --> 18:22.490]  So, folks may have seen the headlines that the UK government recently passed this law, the Investigatory Powers Act.
[18:22.730 --> 18:30.550]  And what it does is it lets cops order any private service provider to give access to that provider's customer data.
[18:32.130 --> 18:43.070]  And if the provider can't give access to the data because the data is encrypted, the cops can require that provider to make a backdoor until they're able to turn over the data.
[18:44.870 --> 18:50.850]  So, basically, saying that your data is zero-knowledge encrypted and that you can't comply is not an excuse.
[18:51.050 --> 18:53.170]  It's not a justification in the UK anymore.
[18:53.310 --> 18:57.950]  And the first test that the UK authorities are making of this law is with Apple.
[18:59.230 --> 19:03.750]  So, UK cops have demanded that Apple turn over iCloud backups.
[19:04.750 --> 19:08.050]  Apple says, oh, I'm sorry, our iCloud backups are encrypted.
[19:08.470 --> 19:10.210]  We're unable to provide them to you.
[19:11.430 --> 19:15.730]  And this is not a valid excuse in the UK anymore.
[19:15.910 --> 19:21.890]  And so, Apple has responded to this by removing their iCloud backup feature for UK users.
[19:22.130 --> 19:35.150]  So, if you're in the UK and you used to encrypt your iCloud backup, Apple is now preventing you from doing that encryption, specifically so that they can comply with government requests for your data when the cops ask for them.
[19:36.850 --> 19:45.690]  You know, in a similar vein, Signal has said that if Sweden outlaws cryptography, that they will stop operating in Sweden.
[19:45.890 --> 19:48.330]  And there's similar kind of dynamics going on in Australia.
[19:48.590 --> 19:52.710]  We might say, well, in the United States, this will never happen.
[19:52.710 --> 19:54.090]  We have a different legal regime.
[19:54.270 --> 19:55.590]  And maybe this is true.
[19:55.870 --> 20:04.650]  But in a future where the U.S. is kind of the only Western country that's a holdout in this respect, I feel like the political climate starts looking different.
[20:06.350 --> 20:09.570]  And then, of course, there's just straight criminalization.
[20:09.570 --> 20:26.830]  So, last year, the French government arrested the Telegram CEO, charged him with drug trafficking, distribution of child pornography, money laundering, fraud, concealment, a whole bunch of other things.
[20:27.010 --> 20:31.150]  And mind you, the authorities didn't claim that he had done these things.
[20:31.750 --> 20:43.130]  They claimed that Telegram, the platform that he's the CEO of, was complicit in these crimes because it allowed users to remain anonymous and it didn't moderate them enough.
[20:44.950 --> 20:50.550]  Now, we might say, okay, but Telegram, not fully end-to-end encrypted, right?
[20:51.910 --> 20:58.030]  If Telegram had had better end-to-end encryption, then maybe the CEO couldn't be pressured to cooperate like this.
[20:58.030 --> 21:02.390]  Maybe he could have claimed, look, I had no idea what was happening on my platform.
[21:02.590 --> 21:03.670]  I didn't know the users.
[21:03.790 --> 21:05.310]  I had no control over anything.
[21:06.270 --> 21:10.970]  Well, this brings us to the tornado cache situation.
[21:11.230 --> 21:16.710]  So, Alexey Perzov was just a developer of a zero-knowledge application.
[21:16.730 --> 21:18.550]  And he built his code right.
[21:18.670 --> 21:19.350]  He did it well.
[21:19.550 --> 21:32.010]  He built a tool which anonymized cryptocurrency transactions in a way that neither he nor anybody else could identify the users or have any control over what anybody was doing on the tool, right?
[21:32.250 --> 21:34.350]  Completely cryptographically, like, secured.
[21:35.630 --> 21:39.290]  He was convicted of money laundering in the Netherlands, and he is now in prison.
[21:40.730 --> 21:50.430]  Prosecutors argued that Perzov, quote, made choice writing the code and deploying the code, all the while he knew that criminal money was entering the system.
[21:52.850 --> 22:00.350]  Roman Storm, the other co-founder of TornadoCash, has been indicted in the U.S.
[22:00.410 --> 22:01.450]  and is still awaiting trial.
[22:05.040 --> 22:10.660]  So, the takeaway from these examples is that actually organization is the vulnerability.
[22:11.820 --> 22:19.500]  It's popular to say things like, you can't outlaw code, or encryption is just math, and you can't outlaw math.
[22:19.720 --> 22:27.100]  And these things are true, but what the state is really good at doing is outlawing people and organizations.
[22:27.100 --> 22:37.300]  And this is the core problem with depending on centralized encrypted services as kind of, like, the core solution against social control.
[22:37.520 --> 22:38.340]  It's not technical.
[22:38.700 --> 22:40.240]  It's political and economic.
[22:41.940 --> 22:43.700]  Mostly it's economic, really.
[22:44.380 --> 22:48.800]  Designing good encrypted apps is really hard.
[22:49.100 --> 22:53.500]  It takes a lot of resources, like Moxie is saying in this quote.
[22:54.160 --> 23:03.120]  Even building relatively simple apps requires a group of people to sit in front of a computer for eight hours a day, every day, forever.
[23:05.760 --> 23:12.540]  Mobilizing that kind of resource, being able to aggregate the resources that's necessary to maintain that, requires organization.
[23:12.880 --> 23:14.700]  And that creates the vulnerability.
[23:15.580 --> 23:21.920]  If you want to develop a resource-intensive zero-knowledge app, you basically have two organizational options.
[23:21.920 --> 23:24.660]  Option one, be an above-ground organization.
[23:25.060 --> 23:28.280]  You can operate as a legitimate public institution, right?
[23:28.360 --> 23:29.780]  Like the Signal Foundation, for example.
[23:30.320 --> 23:31.500]  You can do publicity.
[23:31.740 --> 23:33.080]  You can go on the talk circuit.
[23:33.460 --> 23:36.620]  Hopefully you attract money and developer talent to your project.
[23:36.900 --> 23:42.980]  And then, because you're so successful and high-profile, you are targeted with legislation and criminalization.
[23:43.520 --> 23:50.160]  And then your choice becomes you either bend the knee, you accommodate that legislation, or you are destroyed.
[23:52.440 --> 23:58.340]  Okay, you might say, well, that seems like a foolish approach for my technical project, which intends to threaten the powerful.
[23:58.580 --> 24:00.700]  I'm not going to be an above-ground organization.
[24:01.140 --> 24:02.220]  We're going underground.
[24:03.140 --> 24:04.940]  We're going to operate as a secret collective.
[24:05.400 --> 24:08.240]  We're going to always hide our identities, only ever operate over Tor.
[24:08.560 --> 24:10.960]  And because of this, we're going to have no money.
[24:11.080 --> 24:11.280]  Right?
[24:11.340 --> 24:15.860]  It's very hard to raise VC money if you're a secret underground collective.
[24:16.560 --> 24:26.340]  You're going to scare away engineering talent, or worse, like in the tornado cache example, your engineering talent is going to get criminally targeted for its association with your underground project.
[24:26.860 --> 24:30.180]  And because of this, your project's going to languish.
[24:30.380 --> 24:30.440]  Right?
[24:30.560 --> 24:32.040]  It's not going to, like, be destroyed.
[24:32.460 --> 24:34.220]  It's true, you can't outlaw code.
[24:34.220 --> 24:47.420]  But the, you know, the building full of people writing code all day, every day, to, like, do the bug fixes, do the security patches, expand the features in response to the user-based needs, all of those things are very hard to do.
[24:47.420 --> 24:51.600]  And because of this, the project's just kind of like... they just languish.
[24:53.820 --> 25:02.580]  So, either way, the state makes it... it makes it extremely difficult to succeed at developing zero-knowledge apps.
[25:03.140 --> 25:05.580]  And it's already hard, even without the state being involved.
[25:05.720 --> 25:10.260]  The technical challenges alone in building these things make it very slow and costly.
[25:10.260 --> 25:19.320]  Like, Signal... I keep using Signal as an example, but, like, Signal is the most successful zero-knowledge app probably ever built, in my opinion.
[25:19.520 --> 25:24.760]  And look at how long it takes their team to implement features that other apps had, like, a decade ago.
[25:26.200 --> 25:28.480]  This is not their fault, by any means.
[25:28.680 --> 25:30.420]  This is not a dig on Signal.
[25:30.580 --> 25:40.600]  Their team has accomplished probably some of the most important wins against technical social control since, like, the Internet or, like, asymmetric encryption or something.
[25:40.920 --> 25:47.760]  But the point is, it's foolish to assume that everyone can easily repeat that kind of success.
[25:50.420 --> 26:00.180]  And so, beyond just, like, the threats, there are needs, which are emerging, which zero-knowledge tools cannot keep pace with.
[26:01.340 --> 26:09.620]  Radical movements are doing things at increasing scale, with increasing political sophistication, logistical sophistication.
[26:09.800 --> 26:11.840]  This kind of thing is good.
[26:11.840 --> 26:12.580]  It's important.
[26:12.800 --> 26:13.320]  It's inevitable.
[26:13.680 --> 26:19.520]  If popular movements are ever going to contend meaningfully with the infrastructure of the state, this must happen.
[26:20.120 --> 26:29.220]  You know, like, the people who are working on disaster response logistics, you know, they're hoping to supplant the functions of FEMA, right?
[26:29.260 --> 26:30.340]  Like, the federal government.
[26:31.060 --> 26:41.460]  The type of mass protest tactics and coordination that we're seeing now, like these folks in Hong Kong, they've got, like, advanced, on-the-ground logistics.
[26:41.720 --> 26:43.500]  They're doing, like, mapping.
[26:43.500 --> 26:48.840]  They're, like, synthesizing and proliferating real-time intelligence of things that are happening on the street.
[26:49.680 --> 26:52.800]  This is the kind of organizing that we've never seen before.
[26:54.800 --> 26:57.180]  And we're seeing all of these emerging crises, right?
[26:57.260 --> 27:00.220]  Like, abortion access, post-Roe.
[27:00.620 --> 27:02.260]  It's basically a national crisis.
[27:02.600 --> 27:06.340]  And the things to do about it are all pretty obvious, right?
[27:06.440 --> 27:09.020]  Like, get people access to reproductive care.
[27:09.180 --> 27:20.840]  But doing these things at the scale that is now required, in the face of malicious authorities, who want to, like, jail people and hurt people, this stuff has never really been attempted.
[27:21.160 --> 27:23.980]  And, you know, here we're talking about healthcare, right?
[27:24.040 --> 27:35.840]  This is, like, serious logistics, data management, records security, communication coordination, you know, all of this kind of stuff that we're, like, just now figuring out what is needed.
[27:35.840 --> 27:39.700]  And it's not just kind of, like, new radical initiatives.
[27:40.000 --> 27:52.700]  Existing basic social infrastructure, things like humanitarian aid to migrants, to the poor, to people of color, is being quite abruptly, even just this year, is being criminalized.
[27:54.720 --> 28:08.020]  This graphic is a slide from a presentation that I saw about the DOJ's orders to use code 1324 to jail nonprofit humanitarian workers as human smugglers.
[28:09.740 --> 28:12.940]  These are organizations that already operate at scale.
[28:13.200 --> 28:19.460]  They already have sophisticated logistics pipelines that are, you know, necessary for keeping people safe and keeping them alive.
[28:19.700 --> 28:25.420]  And now, they suddenly have to worry about data surveillance by an authoritarian executive branch.
[28:27.580 --> 28:32.160]  The tools that we currently have are not adequate to this kind of challenge.
[28:33.540 --> 28:38.100]  A signal group and a rise-up pad are not enough to build a future we can survive in.
[28:40.980 --> 28:54.220]  We need tools that can handle much more sophisticated workflows, that can adapt to new circumstances, that can accommodate the kind of breakdowns that we're seeing emerging in society and politics, that can exploit emergent opportunities.
[28:54.480 --> 29:03.920]  And we cannot wait for specialist engineers to design the perfectly secure tool that has every feature that we could possibly need for all of these scenarios.
[29:04.200 --> 29:11.460]  We need the ability to use what's already here with some degree of safety and turn it toward our purposes.
[29:12.900 --> 29:17.700]  So this is kind of like the dilemma that people in social movements are facing.
[29:17.940 --> 29:23.000]  On one hand, we have traditional web services, which are a target for data aggregation.
[29:23.000 --> 29:25.120]  They're like a perfect honeypot for surveillance.
[29:25.460 --> 29:28.460]  They're also a choke point for manipulation, for censorship.
[29:28.780 --> 29:33.420]  And then we've got zero-knowledge services, which posit a kind of alternative to this.
[29:33.680 --> 29:35.660]  But they come with their own limitations.
[29:36.240 --> 29:42.960]  They're slow to develop, they're costly to maintain, lacking in features, and they themselves become major political targets.
[29:44.220 --> 29:47.100]  So what is the third option?
[29:47.380 --> 29:51.020]  We need something that goes beyond the proposals so far.
[29:51.620 --> 30:02.400]  And in particular, we need something that starts from our position as organizers, as participants in social movements, not just as kind of like generic users on an abstract Internet.
[30:03.060 --> 30:08.080]  We need options that can consider our needs and leverage our specific capacities.
[30:08.880 --> 30:13.940]  And so to think through this, I want to offer this concept as a starting point.
[30:14.580 --> 30:15.820]  Data autonomy.
[30:16.240 --> 30:25.540]  Data autonomy is a framework for building collective local power over our shared data and how it's used based on material control over infrastructure.
[30:26.940 --> 30:39.440]  The material control over infrastructure part is really important because this offers us another path to opacity and data ungovernability other than zero-knowledge encryption.
[30:39.660 --> 30:42.740]  Not to say that zero-knowledge encryption is, like, bad.
[30:42.880 --> 30:44.120]  It's extremely important.
[30:44.740 --> 30:47.560]  But this offers us a potential second path.
[30:48.640 --> 30:55.060]  And so when we're talking about material control over infrastructure, what I'm talking about is, like, where does our data actually live?
[30:55.060 --> 30:57.100]  Who controls the machines that process it?
[30:57.260 --> 31:00.300]  Is our data in a massive Google data center like this?
[31:00.560 --> 31:01.840]  Is it in our closet?
[31:02.500 --> 31:04.180]  Is it in our friend's closet?
[31:04.400 --> 31:07.000]  Is it at the union hall, at the local hacker space?
[31:07.440 --> 31:11.800]  Is it on a server somewhere else in the world with better data privacy laws?
[31:12.900 --> 31:21.080]  Where the data lives, who has physical access to it, and the hardware that's processing it, are key determiners of who has power over that data?
[31:22.940 --> 31:35.180]  If you remember the NSA slide with the little smiley face, the question of where exactly encrypted data gets decrypted is of key interest to the authorities.
[31:35.380 --> 31:39.660]  And so it should be of key interest to us because that is the point at which power can be exerted.
[31:42.640 --> 31:47.520]  So you may be thinking at this point, like, it sounds like we're talking about self-hosting.
[31:49.020 --> 31:51.460]  And, like, yes and no.
[31:51.920 --> 31:59.360]  Yes, we are talking about, like, taking direct responsibility for data infrastructure and not outsourcing it to, like, the cloud.
[32:01.180 --> 32:10.700]  But we have to do something other than the individualized DIY approach, the approach of, like, hobbyists and basement tinkerers that many of us are familiar with.
[32:10.840 --> 32:20.420]  The goal here is that every political formation which seeks to challenge power is also able to operate its own data infrastructure.
[32:20.780 --> 32:29.740]  The operating data infrastructure is seen as a core aspect of political organizing in the same way that in previous eras operating a printing press was.
[32:31.060 --> 32:35.120]  And so this is the importance of collective local power.
[32:35.360 --> 32:39.080]  Like, what does it mean to build collective local power over data?
[32:40.220 --> 32:42.860]  This is actually a political question.
[32:44.520 --> 32:48.500]  In my analysis, collective local power over data requires two things.
[32:48.900 --> 32:55.500]  The community has processes for deciding how it would like to manage its data, how it aspires to manage data.
[32:55.500 --> 33:03.080]  And then the community collectively has the skills and the ability to exercise the material control that we talked about.
[33:03.360 --> 33:06.060]  And the collective piece is important here, right?
[33:06.220 --> 33:09.340]  The key concepts are that data is not individual.
[33:09.900 --> 33:15.200]  Data about me is also data about you because we are socially connected.
[33:15.460 --> 33:21.180]  And so to manage and secure that data effectively, we must do it at the level of social affinity.
[33:21.920 --> 33:25.330]  Or put otherwise, we must do it at the level of political organization.
[33:27.600 --> 33:37.540]  These pictures are from a Latin American project called The School of Communication and Free Technologies for the Common Defense of the Territory.
[33:38.660 --> 33:39.800]  Very cool project.
[33:40.040 --> 33:41.400]  I would encourage folks to look into it.
[33:43.460 --> 33:49.940]  Okay, but so the point here is collective local power is our political goal within social movements, right?
[33:50.040 --> 33:52.460]  It is the way that we move toward our political ideals.
[33:52.720 --> 33:58.040]  And collective local power is also our strength and our edge when it comes to countering surveillance.
[33:58.320 --> 33:59.780]  So we should lean into that.
[34:02.160 --> 34:05.920]  So, okay, so what are we talking about in concrete terms?
[34:06.020 --> 34:09.740]  We're talking about building collective autonomous data infrastructure.
[34:09.740 --> 34:12.940]  We're talking about using existing open-source applications.
[34:13.320 --> 34:15.360]  You know, stuff that you all are familiar with.
[34:15.600 --> 34:21.300]  Probably things like next cloud, rocket chat, Jitsi, base row.
[34:21.920 --> 34:29.600]  Taking tools like these and having them hosted and managed by the political formations which use them and depend on them.
[34:31.760 --> 34:33.220]  Using existing tools...
[34:33.220 --> 34:34.820]  Okay, so there's some advantages to this.
[34:35.080 --> 34:38.620]  Using existing tools means that you can depend on...
[34:38.620 --> 34:42.360]  That you're depending on social trust rather than zero-knowledge encryption.
[34:43.400 --> 34:46.800]  And in some ways maybe this feels like a compromise, right?
[34:46.880 --> 34:48.160]  Or a weakening of security.
[34:48.380 --> 34:53.040]  But the value here is that it removes the burden of zero-knowledge development.
[34:53.340 --> 34:59.120]  We can use tools without having to provide the kind of security guarantees that zero-knowledge encryption does.
[34:59.240 --> 35:04.440]  Because we can leverage the social trust that exists from like real political organizing.
[35:06.020 --> 35:13.260]  And then secondly, having these tools managed by the formations which use them avoids the rise-up.net...
[35:13.260 --> 35:15.900]  What I have come to call the rise-up.net effect.
[35:16.740 --> 35:18.180]  We all love rise-up.
[35:18.960 --> 35:30.900]  But there's this phenomenon where like a ragtag group of anarchists form a tech collective and then suddenly they become responsible for all of the data infrastructure of all anarchists in North America.
[35:31.320 --> 35:31.720]  Right?
[35:31.820 --> 35:33.000]  They didn't ask for this.
[35:33.280 --> 35:36.960]  They inherited this because they were the ones who did it when nobody else was.
[35:38.980 --> 35:44.540]  We need to be able to build an ecosystem where the formations that depend on these tools are also the ones who are managing them.
[35:46.080 --> 35:48.440]  All right, so what are the problems with this idea?
[35:49.260 --> 35:55.040]  Many of you may be thinking like, really, you want every radical organization to be running their own data services?
[35:55.280 --> 35:57.040]  It's not like nobody thought of this before.
[35:57.320 --> 35:58.260]  That is hard.
[35:58.420 --> 35:59.460]  That is a lot of work.
[35:59.660 --> 36:01.220]  Who's going to do all the work?
[36:03.000 --> 36:08.120]  You know, like if we want everybody to run all of this stuff, we're going to need a lot more trusted experts.
[36:11.140 --> 36:14.260]  This is actually a labor problem.
[36:15.440 --> 36:19.700]  And like many other labor problems, the solution is automation.
[36:22.420 --> 36:25.100]  I'm sure Marx would have some thoughts about this part.
[36:27.380 --> 36:36.600]  But yeah, I mean, so the concept of DevOps, right, like automating the management of service deployment is relatively new.
[36:37.720 --> 36:43.080]  And, you know, like maybe within the past decade, DevOps has been like an emerging field in industry.
[36:43.240 --> 36:44.720]  And it's never really been tried.
[36:45.260 --> 36:48.140]  It's never been applied seriously to radical practice.
[36:48.140 --> 37:06.880]  The notion here is that we can take the work of configuring, securing, et cetera, managing infrastructure, and like commodify that as code the same way that free software commodifies the labor of software developers, and then scale that to many different instances.
[37:07.960 --> 37:16.220]  What this means is that centralization is good, actually, when it eliminates redundant work and allows scaling.
[37:16.220 --> 37:21.220]  But centralization is bad when it aggregates political power.
[37:22.380 --> 37:33.920]  And that is why, in order to do this kind of thing, we must maintain that code and that infrastructure as a global commons to present, to avoid the centralization of that technical power.
[37:35.500 --> 37:36.780]  Okay, next problem.
[37:39.020 --> 37:46.920]  A certain percentage of you, probably, are thinking that this entire idea is like the most cursed thing possible.
[37:48.440 --> 37:53.480]  You are thinking that DevOps is a nightmare world of buzzwords and overcomplicated enterprise shit that doesn't work.
[37:54.600 --> 37:59.120]  I salute you, fellow sys-admins, DevOps, knowers, you are not wrong.
[38:01.620 --> 38:04.940]  You know, Kubernetes is not the answer to our problems.
[38:05.240 --> 38:07.660]  We are not going to be able to run radical infrastructure.
[38:11.180 --> 38:12.400]  Somebody had to say it.
[38:12.400 --> 38:17.840]  Yeah, like, this is not like circle CI land here, right?
[38:18.220 --> 38:20.600]  These tools were built for our enemies.
[38:20.940 --> 38:24.800]  They were built to solve their problems, to play towards their strengths.
[38:25.960 --> 38:33.460]  You know, free open-source software is not actually just a magic machine that produces whatever we need.
[38:33.460 --> 38:43.820]  It produces what people need for some value of people where, you know, people is like a white dude in California who wants to launch a startup.
[38:45.660 --> 38:47.940]  And a lot of times, actually, that's okay.
[38:48.560 --> 38:53.840]  You know, in terms of like interfaces, workflow, database architecture.
[38:54.520 --> 38:58.580]  You know, often what that guy needs is the same thing as what we need, right?
[38:58.580 --> 39:03.320]  The database that works for California startup dude works just fine for us, too.
[39:03.600 --> 39:10.460]  But when it comes to questions like physical resources, threat models, we are not the same.
[39:11.280 --> 39:16.560]  If we want automation infrastructure that works for us, we will have to build it.
[39:17.900 --> 39:28.160]  And so I want to talk about a particular software project, which those of us at Movement Infrastructure Research think embodies the kind of principles that I've outlined so far.
[39:28.580 --> 39:29.680]  Co-op cloud.
[39:31.520 --> 39:34.740]  Co-op cloud is public interest infrastructure.
[39:35.400 --> 39:39.440]  It is an alternative to corporate clouds built by tech co-ops.
[39:40.520 --> 39:41.760]  So what does it do?
[39:42.480 --> 39:47.380]  It is the tooling that you use for common service hosting tasks.
[39:47.380 --> 39:56.040]  It handles things like deploying web application, configuring that application, upgrading it, doing backups, migrating it between server environments.
[39:56.220 --> 40:01.980]  All of the basic tasks that are the burden that makes it difficult for people to actually run their own shit.
[40:03.120 --> 40:04.880]  What does it help you host?
[40:05.120 --> 40:06.220]  Lots of stuff.
[40:06.960 --> 40:08.540]  Software for handling databases.
[40:08.980 --> 40:10.620]  Software for handling case files.
[40:10.840 --> 40:11.540]  Shipping records.
[40:11.820 --> 40:12.460]  Project management.
[40:13.200 --> 40:14.240]  Creative design.
[40:15.100 --> 40:16.960]  Handling, doing communication at scale.
[40:17.260 --> 40:30.200]  All of the kinds of things that, you know, like I was talking about earlier, vibrant, creative, emergent social movements need to be able to handle, that they cannot currently do with the zero-knowledge tools available to them.
[40:31.600 --> 40:34.100]  Co-op cloud has very flexible computing requirements.
[40:34.560 --> 40:40.900]  You need an IP, a domain name, and basically any Linux server that can run Docker.
[40:41.780 --> 40:42.920]  These things are cheap.
[40:43.100 --> 40:44.140]  They are simple to procure.
[40:45.480 --> 40:49.500]  They could even be procured without giving up any personally identifying information.
[40:51.220 --> 40:57.400]  So I'm just going to like run through really quick, a kind of like demo of like what this looks like really.
[40:58.580 --> 41:00.400]  So there's a command line tool.
[41:00.700 --> 41:05.840]  You run a command like this to provision a new instance of, in this case, next cloud.
[41:05.840 --> 41:06.540]  Is this?
[41:06.700 --> 41:07.760]  Yeah, that's legible.
[41:08.980 --> 41:13.400]  In place of next cloud, you could put any other, any number of other applications.
[41:13.880 --> 41:17.860]  You know, there's an entire database of catalogs of software that can be deployed with the tool.
[41:20.100 --> 41:23.560]  You run this command and then it asks you what server do you want to deploy it on?
[41:24.100 --> 41:26.380]  What domain name do you want it to be available at?
[41:26.980 --> 41:34.280]  You tell it that and then it offers for you to run this other command, config, if you want to customize the deployment.
[41:34.580 --> 41:42.800]  And if you do, then it gives you this kind of like text-based configuration file that has app-specific settings.
[41:43.680 --> 41:49.320]  It comes pre-baked with a whole bunch of same defaults that work out of the box, but you can change these things if you need to.
[41:51.000 --> 41:55.220]  You generate some secrets that are specific to this application, right?
[41:55.340 --> 42:00.700]  Things like API keys, passwords, you know, that can't be baked into the automation.
[42:02.000 --> 42:03.720]  And then you're good.
[42:03.980 --> 42:04.760]  You hit deploy.
[42:05.900 --> 42:15.100]  The thing gets deployed and now you have an available, like a publicly available next cloud instance.
[42:16.180 --> 42:19.600]  And you can edit documents, you can do all the stuff you can do with next cloud.
[42:20.940 --> 42:22.440]  Okay, so this is cool.
[42:22.640 --> 42:28.580]  This is like the kind of slick tech demo thing where I show you the happy path and everything like works just perfectly, right?
[42:29.120 --> 42:30.980]  But what is happening under the hood here?
[42:31.540 --> 42:35.980]  The recipe which makes all of this automation happen is in a public repo.
[42:36.380 --> 42:40.700]  Anybody can create new recipes for new applications or help to maintain these ones.
[42:41.380 --> 42:46.420]  And the recipes themselves, the meat of it, is basically just Docker Compose files.
[42:47.520 --> 42:49.640]  Many of you hopefully familiar with this.
[42:49.940 --> 42:55.620]  This is an important aspect of this project, is that it's building on top of a whole bunch of existing public standards.
[42:56.760 --> 42:58.880]  It is doing one thing and doing it well.
[42:59.360 --> 43:03.540]  And this makes the technology fast to learn, makes it maintainable.
[43:03.760 --> 43:10.440]  It means that there's a large pool of existing experts who can be drawn on to contribute to this project and help to develop it.
[43:11.280 --> 43:20.420]  But perhaps more important than any of these kinds of like cool technical aspects is the political and economic context surrounding the software.
[43:21.540 --> 43:23.480]  Who produces the software, right?
[43:23.660 --> 43:26.740]  Because the organization is the vulnerability, like I said before.
[43:27.540 --> 43:32.720]  It is developed by a federation of co-ops and radical collectives that are internationally dispersed.
[43:34.100 --> 43:35.380]  Autonomic is in the UK.
[43:35.860 --> 43:38.500]  I think class and method is in Germany.
[43:39.400 --> 43:42.360]  Abiyah Yalala is in Latin America.
[43:43.800 --> 43:46.340]  MIR, the project that I'm with, is of course based in the U.S.
[43:47.440 --> 43:53.620]  This complicates political attacks and it also decentralizes like the political power over the direction of the project.
[43:55.500 --> 44:00.400]  Co-op cloud also has political values in addition to technical ones.
[44:01.740 --> 44:04.440]  It holds privacy and autonomy as political values.
[44:04.720 --> 44:06.440]  It has a non-commercial economic model.
[44:07.260 --> 44:08.900]  Technical ecosystem of allies.
[44:09.040 --> 44:16.960]  Okay, so what this means is when you contribute to the software commons of this project, it's primarily bolstering our political allies.
[44:16.960 --> 44:20.660]  It's not giving free labor to companies which want us dead.
[44:23.260 --> 44:26.440]  Okay, so I think my time is running low.
[44:26.800 --> 44:28.780]  That is the end of the commercial for co-op cloud.
[44:30.620 --> 44:32.940]  This is the rousing call to action.
[44:33.320 --> 44:44.500]  If you are an organizer and an activist, what you should do is you should operate autonomous infrastructure collectively within the political formation that you already use to impact the world.
[44:45.060 --> 44:49.420]  And you should just personally use these kinds of tools to show that it can be done.
[44:50.340 --> 44:54.360]  If you are an engineer, you should stop DIYing your tools.
[44:55.240 --> 44:58.660]  And what that means is don't build custom stuff only for you.
[44:59.060 --> 45:07.280]  If you see problems that you think need to be solved, especially around software, contribute to the autonomous infrastructure commons.
[45:07.860 --> 45:08.420]  Collaborate.
[45:08.420 --> 45:11.300]  But stop contributing to open-source.
[45:11.720 --> 45:23.240]  You know, the same way that I said before, like, open-source broadly is largely just like a pool of value being exploited by the Amazons and the Googles of the world who want nothing but to erase us.
[45:24.940 --> 45:32.360]  Instead, we should form free software syndicates that can organize the free and open-source software world towards liberatory goals.
[45:32.360 --> 45:38.100]  There's this publication, Synware, free software syndicates, that I would recommend people read.
[45:38.400 --> 45:39.560]  I found it very informative.
[45:40.140 --> 45:42.080]  I have some copies of it up here, too.
[45:42.200 --> 45:45.060]  If anybody's interested, come grab one from me.
[45:46.680 --> 45:47.600]  And that is it.
[45:47.760 --> 45:50.900]  Here are some links of things that you could look into further.
[45:51.960 --> 45:53.620]  Hopefully there's time for a few questions.
[45:53.620 --> 46:03.260]  I want to stress that, like, I think probably some of the things that I've postulated here are controversial, and so I welcome critical feedback.
[46:24.070 --> 46:38.630]  So, I really resonate with what you said about the technical difficulties of working through these projects and keeping it up within local communities and communities of activists.
[46:38.630 --> 46:54.970]  In my experience, even the simpler thing, even do it yourself, is very hard to maintain in a local community, especially if it is not a community that gravitates around hacking.
[46:54.970 --> 47:10.010]  Therefore, that tends to drive a power or a perception of power around the ones who actually have the technical power to change the configuration and to maintain it.
[47:10.170 --> 47:24.330]  That also comes with the burden of keeping it up, and very often against the individual freedom to dedicate themselves on other things, maybe more political activities, while the configuration has to be fixed.
[47:24.330 --> 47:42.450]  So, I was wondering how, in a sense, operating through software that is developed through this federation of co-ops, is that the response to that situation where only one knows how the system works?
[47:43.070 --> 47:47.870]  And how does that really solve the problem?
[47:49.530 --> 48:01.870]  Yeah, I mean, the kind of threat of technocracy, I think, always looms with all technical efforts, no matter how open-source they are, because of the bar, the skill bar, right?
[48:02.330 --> 48:15.270]  And because, as we understand, most of the people who understand how to do any of these things are freaks, and it's not reasonable for us to expect that all people who want to participate in politics become like us.
[48:16.430 --> 48:22.190]  Part of the thing that I think is important about projects like this is that they're seeking to bridge that gap, right?
[48:22.550 --> 48:31.010]  There's a specific technical need of capabilities that people need, and they need them to exist with a certain type of political autonomy.
[48:31.190 --> 48:33.910]  And there's a gap that prevents them from doing that.
[48:34.330 --> 48:38.090]  And a lot of the research that I'm interested in is just like, what is that gap?
[48:38.250 --> 48:40.970]  And what can technical people do to try to bridge it?
[48:40.970 --> 48:44.930]  We're probably not the ones... like, we probably don't have all of the solutions.
[48:45.170 --> 48:46.990]  Like, we can't completely solve that problem.
[48:47.390 --> 48:53.310]  But there's a lot of work that we're kind of avoiding doing, because things work for us, right?
[48:53.470 --> 48:58.230]  Because, like, I know how Docker works, so, like, why would I need to make it any easier than that?
[48:58.410 --> 49:03.330]  And projects like Co-op Cloud are oriented towards, like, closing that gap, I think, is the important part.
[49:06.070 --> 49:10.490]  Yeah, so, my main criticism... can you hear?
[49:10.650 --> 49:10.850]  Yeah.
[49:11.410 --> 49:19.070]  My main criticism is something like this, is that when I use a piece of software like Signal, I'm using it.
[49:20.610 --> 49:23.790]  The... Pete Hegseth is using it to send classified information.
[49:24.210 --> 49:29.430]  Everyone is using it, and it's not that interesting that I'm the one using it, because my family's using it.
[49:29.430 --> 49:37.110]  I might just be messaging them, or I might be organizing something that would get me a RICO charge, which I'd love to talk to you afterwards about.
[49:39.670 --> 49:40.330]  Of course.
[49:40.590 --> 49:49.630]  But the main issue with this that I see is that, all of a sudden, you have monitorable network traffic that's saying, okay, I'm a radical activist.
[49:49.830 --> 49:50.850]  I like this group.
[49:51.050 --> 49:52.550]  I use their digital services.
[49:52.630 --> 49:56.170]  It creates a pretty juicy and pretty specific honeypot.
[49:56.270 --> 49:57.350]  I don't know about the legal side.
[49:57.350 --> 49:58.830]  You probably know more about this than me.
[49:59.030 --> 50:13.970]  That would probably be easier to convince a judge to completely infiltrate and dismantle, compared to a large service that could have more legal representation and is less radical and less underground.
[50:13.970 --> 50:26.910]  So I'm really mainly wondering how you could improve the characteristics to make it a bit more like blending into the crowd, essentially.
[50:27.990 --> 50:28.590]  Yeah.
[50:28.790 --> 50:31.150]  I mean, I think this is a very valid concern.
[50:31.650 --> 50:38.530]  And I think, basically, there are solid arguments, depending on threat model, to be made on either side.
[50:39.150 --> 50:47.190]  Of course, the criticism that we could make of centralized zero-knowledge platforms or other things like this is that they have their own kind of aggregating function.
[50:47.490 --> 50:47.530]  Right?
[50:47.850 --> 50:57.690]  Like, something like signal is so high-profile that, especially in repressive regimes, anybody who's pegged as connecting to the signal servers, it's immediately flagged what they're up to.
[50:57.690 --> 50:58.170]  Right?
[50:58.490 --> 51:10.050]  And so, like, one argument could be made that by decentralizing this kind of function to many, many servers that are, like, community-oriented, that it blurs the lines.
[51:10.230 --> 51:15.050]  And that makes it actually harder to identify exactly what somebody's up to just because they're connecting to some IP.
[51:15.310 --> 51:29.990]  And if you combine that with the capability to easily migrate services from service to service, from IP to IP, maybe there's a hope that this creates a kind of, like, fog of what's going on.
[51:30.930 --> 51:45.950]  But there's also a serious argument, I think, on the other end, that, like, if you're having many different people operate these kinds of nodes, and they're not prepared to secure them as well as the signal foundations of the world, that there's a risk there.
[52:04.330 --> 52:05.110]  Yeah, definitely.
[52:05.490 --> 52:19.110]  I think, like, a significant part of the value proposition of something like this is that by proliferating the targets, you actually, like, deplete your adversary's ability to focus their energy and invest their energy heavily on, like, one attack.
[52:20.870 --> 52:22.370]  But, yeah, there's trade-offs there.
[52:22.710 --> 52:25.790]  Okay, I'm told that I have less than one minute, so I don't know if...
[52:25.790 --> 52:26.170]  Real quick.
[52:28.210 --> 52:28.690]  I...
[52:28.690 --> 52:34.590]  First of all, I really like this, so this isn't a criticism so much as a question, but...
[52:34.590 --> 52:41.010]  So you mentioned a call to action for technical operators, and I had a...
[52:41.010 --> 52:42.130]  Whoa, now I can hear myself.
[52:44.550 --> 52:51.950]  The design choice that you made, and I, you know, I agree, I hate Kubernetes, I have to use it every day.
[52:52.650 --> 53:04.510]  Why didn't you pick a tool that the industry is pushing so hard, you know, so that you have more labor available to you to do this kind of thing?
[53:04.910 --> 53:06.610]  Yeah, I mean, it's an important trade-off, right?
[53:06.670 --> 53:13.730]  Like, there's values to be gained from using the thing that is heavily invested in by industry, but you also lose autonomy, right?
[53:14.190 --> 53:19.630]  Kubernetes is driven by Google, by behemoth industries that have far more influence than we do.
[53:19.630 --> 53:25.370]  If Kubernetes moves in a direction, and we're dependent on it, we can but follow, right?
[53:25.450 --> 53:26.550]  Like, we have no agency there.
[53:26.690 --> 53:26.810]  Yeah.
[53:27.030 --> 53:37.410]  And it's making decisions based on the needs of enterprises, which are our enemies, and which, you know, do not have our same values, or our same technical needs.
[53:37.590 --> 53:38.850]  So that's kind of the reason.
[53:38.990 --> 53:39.490]  Yeah, okay.
[53:39.990 --> 53:40.670]  Thank you.
[53:41.810 --> 53:42.410]  Thank you.
[53:42.410 --> 53:42.730]  Thank you.
[53:42.730 --> 53:42.770]  Thank you.