[00:00.000 --> 00:01.840]  Thank you very, very much.
[00:03.160 --> 00:06.240]  We are the Electronic Frontier Foundation.
[00:07.520 --> 00:16.500]  So I think most of you probably are familiar with us, but just briefly, we are a non-profit organization dedicated to defending your rights online.
[00:16.720 --> 00:20.400]  We fight for privacy, for free speech, for fair use of intellectual property rights.
[00:20.540 --> 00:23.780]  We try and make a future that you would want to live in.
[00:23.860 --> 00:28.980]  And we do this through litigation from our teams of lawyers.
[00:28.980 --> 00:31.280]  I am a lawyer at EFF.
[00:31.400 --> 00:33.200]  I should introduce myself, I guess, actually.
[00:33.400 --> 00:34.880]  My name is Kurt Opsahl.
[00:35.080 --> 00:39.220]  I am the General Counsel and Deputy Executive Director at EFF.
[00:40.260 --> 00:56.140]  And we do this also through our activist team, trying to raise grassroots support, get people politically active on digital issues, and through our technologists who try and come up with awesome software that will help enhance digital freedom.
[00:56.820 --> 01:10.060]  So we are going to go down the line here and have everybody introduce themselves and say a few words about what has been going on over the last year and what have they been up to.
[01:11.100 --> 01:17.620]  So talk a little bit about some of EFF's legal efforts over the last year.
[01:17.740 --> 01:21.080]  And there's been a number of things, probably too many to really highlight.
[01:21.220 --> 01:23.060]  There's only a few that I wanted to point out.
[01:23.060 --> 01:25.720]  So one, which is big news.
[01:26.000 --> 01:47.720]  Recently, yesterday, we filed a lawsuit against the U.S. government, against the Library of Congress and Department of Justice, concerning the 1201 restrictions on what you can do for hacking and circumventing copyrighted protected materials.
[01:49.120 --> 01:50.040]  Thank you.
[01:51.160 --> 01:53.380]  Very exciting lawsuit.
[01:53.820 --> 01:56.540]  And because 1201 is an extremely problematic law.
[01:56.680 --> 02:00.300]  This was passed as part of the Digital Millennium Copyright Act of 1998.
[02:01.380 --> 02:16.780]  And it was sort of a recognition by the copyright industries that they were failing at providing technology that would be able to secure their devices, that DRM was not working very well at a technical level.
[02:16.780 --> 02:26.660]  And so they wanted to use their advantage in Congress, through their intensive lobbying efforts, to skew the playing field.
[02:26.800 --> 02:35.920]  And to make it illegal to do something that would circumvent digital rights management technology, so that they wouldn't have to try as hard on the technical front.
[02:37.140 --> 02:39.380]  And so they passed this 1201.
[02:39.500 --> 02:41.840]  And people said at the time, hey, this is a big problem.
[02:41.960 --> 02:42.800]  What about fair uses?
[02:42.940 --> 02:44.280]  What about legitimate uses?
[02:44.440 --> 02:45.880]  This is overly broad.
[02:46.420 --> 02:50.200]  And so the legislature said, well, we'll have an exemption thing.
[02:50.320 --> 02:54.400]  So if you think it's being misused, if it's going overly broad, you can claim this exemption.
[02:54.860 --> 02:59.860]  Go to the library in Congress every three years and file a petition to say how it's been bad.
[03:00.260 --> 03:01.780]  And then maybe you'll get an exemption.
[03:02.040 --> 03:03.840]  And so that's been going on since 1998.
[03:04.480 --> 03:07.960]  Every three years, we ask for exemptions.
[03:08.140 --> 03:09.640]  And, you know, some of them have been granted.
[03:09.660 --> 03:11.120]  And that has been great.
[03:11.240 --> 03:12.500]  But many of them have not been.
[03:12.500 --> 03:15.040]  And there still are these restrictions.
[03:15.180 --> 03:26.000]  Unless you get one of these things, you're still prohibited, even if it would be fully protected speech that ordinarily, under our tradition of free expression, would be allowed.
[03:26.720 --> 03:29.140]  And then even if you get one, it goes away.
[03:29.260 --> 03:32.380]  After three years, you have to reapply or the exemption's no good.
[03:32.560 --> 03:36.440]  And this doesn't really square with the principles of free expression that we've had in this country.
[03:36.840 --> 03:41.960]  You shouldn't have to apply to the government for a license in order to engage in protected activities.
[03:41.960 --> 03:52.380]  So we're trying to bring those principles to bear and get the courts to agree that Section 1201 goes too far, hurts too much expression, and isn't the right balance.
[03:53.600 --> 03:56.780]  A couple other things to talk about.
[03:57.660 --> 04:07.580]  Another is our cases against the government for national security letters and also for the warrantless surveillance program.
[04:07.580 --> 04:11.700]  We have ongoing litigation on all of these fronts.
[04:12.280 --> 04:23.100]  Right now, I'm working on a national security letter case, trying to bring it to get a court of appeal to agree that national security letters and the gags that accompany them are unconstitutional.
[04:23.260 --> 04:30.220]  That they shouldn't be automatically prohibited from speaking by something which is issued without court involvement from the FBI.
[04:30.980 --> 04:37.080]  So we're setting the briefing schedule now, and that's going before the Ninth Circuit Court of Appeal over the next year.
[04:38.200 --> 04:42.700]  And another area, one of the things I work on, is our coders' rights project.
[04:42.700 --> 04:53.220]  This is where we try and protect security researchers and allow those researchers to be able to do their research, talk about their research, be able to enhance security by providing more information about vulnerabilities.
[04:53.940 --> 04:58.340]  And one of the major barriers to being able to do that is the Computer Fraud and Abuse Act.
[04:58.520 --> 05:03.420]  This is the federal anti-hacking statute, and it has for many years had a number of problems.
[05:03.580 --> 05:10.700]  It has very extreme penalties and has some broad interpretation.
[05:11.140 --> 05:15.780]  So just quickly, a little bit of news on what's been going on there.
[05:15.780 --> 05:25.040]  There have been a couple of cases that have come out this spring and summer that are somewhat noteworthy.
[05:25.220 --> 05:27.880]  One is the Nozzle case.
[05:28.300 --> 05:31.260]  And this case has actually been around for a while.
[05:31.520 --> 05:32.780]  It has had various rulings.
[05:32.880 --> 05:44.760]  It has had a very good ruling a while back that determined that violating terms of use didn't make you into a federal criminal hacker.
[05:46.360 --> 05:54.220]  Under one interpretation, the DOJ's interpretation of this law, access without authorization was hacking.
[05:54.480 --> 06:05.840]  And so therefore, if a site had, you must be 18 to visit this site, and like Seventeen Magazine did, and you went there and you were 17, you would be committing a felony.
[06:06.600 --> 06:17.940]  And so that case confirmed that if you go to a site and you just violate the terms of use, that in and of itself is not a crime.
[06:18.100 --> 06:18.920]  This is very good.
[06:19.060 --> 06:24.840]  But the two recent cases made some adjustments to that which are somewhat disturbing.
[06:27.560 --> 06:39.340]  So, in the Nozzle case, in addition to violating the, in that case it was an employment agreement, but a functional equivalent to the terms of use for what you could do with the system.
[06:39.840 --> 06:41.980]  There's also password sharing.
[06:42.260 --> 06:48.240]  So, Nozzle and his colleagues had obtained the password of an employee of this organization.
[06:48.240 --> 06:55.840]  They had the password with permission of the password holder and used that.
[06:56.060 --> 07:00.340]  And the court determined that that was a violation of the anti-hacking statute.
[07:00.700 --> 07:03.340]  They didn't believe that you had to actually do a technical hack.
[07:03.460 --> 07:08.820]  You didn't have to defeat a technical protection system, but that sharing a password would be enough.
[07:09.520 --> 07:15.360]  And while I, you know, obviously they were very upset with what Nozzle had done there.
[07:15.760 --> 07:19.260]  But there's a lot of widespread ramifications in this case which could be dangerous.
[07:19.940 --> 07:24.460]  And that we're very concerned about because there are a lot of cases where people might want to share a password.
[07:24.680 --> 07:31.620]  That, you know, if a couple, one wants to share passwords the other so they can take care of some banking.
[07:32.200 --> 07:33.780]  This shouldn't be a federal crime.
[07:34.040 --> 07:44.460]  There are many instances in which, with the authority and permission of the account holder, you should be able to use the account and not being subject to the prosecutorial discretion.
[07:44.720 --> 07:50.320]  The question of whether or not the government will decide to go after you when they could go after you if you wanted to.
[07:50.520 --> 07:56.600]  Because we saw how badly that worked when the government went after Aaron Swartz many years ago.
[07:56.880 --> 08:04.900]  And we're asking for many years in prison for doing something that ultimately the so-called victim of it didn't have a big problem with.
[08:04.900 --> 08:13.080]  And then the second big decision recently was Power Ventures, Facebook versus Power Ventures.
[08:13.640 --> 08:24.340]  In that case, on the plus side, it did acknowledge and reaffirm that merely violating the terms of use was not enough to make it into a CFAA violation.
[08:25.040 --> 08:35.600]  But they also said that if you had been specifically told not to go to a site, in that case they had sent a letter, a cease and desist letter, said stop using our site.
[08:35.700 --> 08:36.720]  You're not allowed here anymore.
[08:37.480 --> 08:38.340]  Go away.
[08:39.320 --> 08:43.380]  That continuing to use it could be hacking.
[08:43.660 --> 08:48.840]  And again, without having to get around any serious technical measures to do so.
[08:48.840 --> 09:07.940]  I think this could be also a very dangerous ruling because it sets up a lot of possibilities where somebody, through sending a letter, could elevate a civil dispute, a thing that would ordinarily be determined by parties in the civil court going over disputes of contract,
[09:08.540 --> 09:09.760]  into a criminal matter.
[09:10.100 --> 09:13.860]  And criminalization of these laws is not the future that we want to live in.
[09:13.860 --> 09:17.500]  So that's just a little bit of what's been going on in the legal world.
[09:17.680 --> 09:19.280]  And I'll turn it over to my colleague, Parker.
[09:20.660 --> 09:21.060]  Thank you, Kurt.
[09:23.060 --> 09:23.920]  Hi, everybody.
[09:24.040 --> 09:24.920]  My name is Parker Higgins.
[09:25.020 --> 09:27.480]  I'm on the activism team at EFF.
[09:27.940 --> 09:31.240]  It's super cool that EFF has an activism team.
[09:32.380 --> 09:41.380]  And a lot of what we do is we bring the issues that we're working on, that we care about, and that you care about, out to the people.
[09:41.480 --> 09:54.240]  And we figure out what the best place for a lot of interested people, a lot of, you know, interested hackers, and people who develop software, and people who have a voice, and people who may vote, the best thing that they can do.
[09:56.560 --> 10:02.860]  The thing that I'm super excited about right now, Kurt just mentioned it, this lawsuit that we filed yesterday.
[10:05.000 --> 10:06.860]  Kurt got a round of applause for it, I don't know.
[10:13.660 --> 10:16.780]  So we work on 1201 issues all the time.
[10:16.980 --> 10:18.800]  We work on DRM issues all the time.
[10:18.960 --> 10:23.120]  This is really the sort of most direct frontal challenge we can launch.
[10:23.340 --> 10:29.440]  And I think a really important part of this is not just filing the lawsuit, but highlighting the issues and bringing this out to the people.
[10:29.580 --> 10:36.640]  And so that's what I envision doing over, you know, not just when we launch, but these things take a lot of time.
[10:38.300 --> 10:41.140]  Like sometimes a depressingly long time.
[10:41.960 --> 10:50.520]  And so we have to keep people updated and keep people aware of what's going on as that progresses.
[10:50.880 --> 10:56.500]  And then the other thing, of course, that we don't do through impact litigation is policy stuff.
[10:56.500 --> 11:09.180]  So one of the big copyright issues that we work on is fair use on platforms like YouTube, where the law is pretty clear about things being fair use.
[11:09.500 --> 11:19.380]  But if content ID flags it, then it bumps you out of the legal system and then bumps you into the content ID track.
[11:20.000 --> 11:28.200]  And I don't know if people, if anyone, by the way, just for reference, the lighting in here is such that I cannot see anything going on.
[11:28.340 --> 11:32.880]  So if there's a glimmer of recognition from YouTube, I have no idea.
[11:35.700 --> 11:46.960]  So I don't know if people are YouTube users, but people who upload videos complain about this all the time, that their videos get taken down or they can't put ads on them or all sorts of things because of content ID.
[11:46.960 --> 11:53.860]  And you can't, there isn't really an avenue to sue over that, which is our preferred problem-solving method.
[11:57.100 --> 12:04.000]  And so, you know, this is working with companies and putting public pressure to try to change policies that way.
[12:04.060 --> 12:08.640]  And we've got a couple of projects to do that sort of thing that hopefully come up in questions.
[12:08.640 --> 12:13.440]  I want to move it along a little bit so that we can get to the part that y'all are interested in.
[12:15.540 --> 12:18.420]  But yeah, so that's what the activism team does.
[12:19.020 --> 12:30.060]  And I'm happy to answer questions, not just about the copyright stuff that I mostly work on, but our activism around policy and legislation on surveillance issues and other things like that.
[12:33.000 --> 12:34.920]  Hi, my name's Vivian.
[12:35.140 --> 12:37.300]  I'm a software engineer at EFF.
[12:37.820 --> 12:40.140]  I'm part of EFF's web development team.
[12:40.360 --> 12:47.020]  So I build sites and tools that support EFF's projects and I also maintain EFF.org.
[12:47.240 --> 12:55.440]  And that's really cool because I get to touch a little bit of everything that EFF does, supporting the projects that activism does and that our tech projects team does.
[12:55.440 --> 12:59.680]  So I'm just going to talk about a few of the projects that I've worked on recently.
[13:00.300 --> 13:08.860]  One was to build a web landing page for our CertBot project, which I think Jacob will probably talk a little more about.
[13:09.140 --> 13:16.460]  But CertBot is a tool that makes it easy to get a certificate through Let's Encrypt and install it.
[13:17.240 --> 13:20.060]  And ease of use is a really important part of that project.
[13:20.060 --> 13:23.560]  So we wanted to make a site that would also make it really easy.
[13:23.560 --> 13:37.540]  So we still have the full documentation, but we built a little widget where users can input the web server operating system and the server that they're using and get tailored instructions at sort of the level of detail that they're looking for.
[13:38.440 --> 13:39.440]  So that was cool.
[13:40.820 --> 13:47.600]  Another project that I worked on recently is a small site about street-level surveillance technologies.
[13:47.600 --> 13:52.240]  So EFF, of course, does a lot of work opposing surveillance at the national level.
[13:52.500 --> 13:58.020]  But we're also doing some work opposing surveillance at the local level with law enforcement agencies.
[13:58.540 --> 14:04.020]  And there's a lot of surveillance that goes on at the local level, and a lot of it is done in secret.
[14:04.020 --> 14:06.280]  So we wanted to make that information more public.
[14:06.280 --> 14:18.800]  And we launched with a focus on two technologies, which are automatic license plate readers, which can read your license plate number and the location where it is.
[14:19.140 --> 14:25.060]  And biometrics, which are sort of unique biological identifiers that people have.
[14:25.880 --> 14:32.940]  And we put together some cool infographics and some pretty extensive FAQs and resources for legal professionals.
[14:33.780 --> 14:39.300]  And then for biometrics, we actually did a cool project where we crowdsourced FOIA requests.
[14:39.640 --> 14:47.220]  So since this stuff is so secretive, there's not a ton of information about how it's being used across the country.
[14:47.420 --> 14:58.860]  So we asked users to submit public records requests to their local law enforcement and get information and share it with EFF so that we could aggregate that information and get a better picture of what's going on.
[14:59.480 --> 15:07.840]  And we're getting ready to add stingrays, which are also known as cell site simulators, to the information on that site.
[15:08.700 --> 15:10.820]  We're going to have a bunch of resources about that too.
[15:11.780 --> 15:16.100]  Cell site simulators are used by law enforcement to track cell phone use.
[15:17.260 --> 15:22.840]  And then the third project that I've been working on recently is our Action Center.
[15:22.840 --> 15:27.680]  So that's an open source platform for political organizing.
[15:27.680 --> 15:29.960]  So it's a tool that's mostly used by Parker's team.
[15:30.580 --> 15:36.240]  So instead of having to come to web dev when they want to do a campaign and say, hey, we need a site about this thing.
[15:36.380 --> 15:39.080]  Can you build us a website that lets users engage in this way?
[15:39.280 --> 15:45.480]  They can spin up an action on their own that can do things like help users call Congress.
[15:46.040 --> 15:49.680]  So they'll learn about an issue and then be able to engage on that issue.
[15:50.600 --> 15:54.100]  And it's open source so other organizations can use it.
[15:54.180 --> 15:56.620]  We'd love it if other nonprofits used this tool.
[15:57.940 --> 16:02.680]  And what I'm working on with that right now is building out some student organizing functionality.
[16:03.100 --> 16:08.780]  So EFF is pushing to do more grassroots work where we are a hub for an action.
[16:09.000 --> 16:14.140]  But we're engaging with organizations around the country who are spearheading it at the local level.
[16:14.140 --> 16:16.580]  And part of that is more on-campus organizing.
[16:16.940 --> 16:24.560]  So what we would like to be able to do is run a campaign nationally.
[16:25.000 --> 16:33.600]  And then allow on-campus university groups to petition their university to take a particular action.
[16:33.600 --> 16:38.640]  Like agree not to sell any patents that come out of their research to patent trolls.
[16:38.640 --> 16:41.240]  So that's what I've been working on most recently.
[16:41.400 --> 16:42.980]  And it's something that I'm really excited about.
[16:43.840 --> 16:48.100]  I'm interested in nonprofit technology and nonprofit web development in general.
[16:48.380 --> 16:49.560]  I like talking about that.
[16:53.330 --> 16:55.050]  I'm Jacob Hoffman Andrews.
[16:55.770 --> 16:59.310]  Parker said that our favorite way of solving problems is to sue.
[16:59.570 --> 17:01.070]  And I think that's true.
[17:01.330 --> 17:04.810]  But we do have two backup plans to other approaches to problem solving.
[17:04.810 --> 17:06.470]  One is to write code.
[17:06.650 --> 17:08.430]  And the other is to write blog posts.
[17:09.810 --> 17:11.750]  I'm one of EFF's technologists.
[17:12.130 --> 17:18.110]  And so that means I'm a multi-class researcher slash activist slash coder.
[17:19.170 --> 17:22.950]  And my biggest current project is called Let's Encrypt.
[17:23.130 --> 17:25.230]  And this falls under EFF's...
[17:25.230 --> 17:26.150]  Thank you.
[17:32.800 --> 17:39.080]  So this falls under EFF's long-running Encrypt the Web project, which has been going since I think at least 2010.
[17:39.800 --> 17:46.900]  I know Parker has spoken a number of times on encrypting the web and has put together our Encrypt the Web scorecard.
[17:47.640 --> 17:52.400]  And so we made a lot of progress there by writing words and saying, you know, you should do this.
[17:52.480 --> 17:53.980]  If you have a website, you should encrypt it.
[17:54.040 --> 17:55.000]  You should use HTTPS.
[17:57.060 --> 18:01.960]  But we also found a lot of websites were stymied by the difficulty of setting up HTTPS on their website.
[18:02.160 --> 18:07.140]  It was expensive, and it was time-consuming, and a lot of people just didn't necessarily know how to do it.
[18:07.260 --> 18:18.780]  Even beyond the cost, which was coming down, the skills needed to figure out how to submit a request and how to prove you on a site, how to install that in your web server was too high a barrier.
[18:19.600 --> 18:28.340]  So we dreamed of this notion of a certificate authority that would not only give you your certificates for free, but would allow you to automate the process.
[18:28.340 --> 18:31.500]  You could just run one command, your whole website is HTTPS.
[18:32.920 --> 18:36.960]  So we put our noses to the grindstone, and we made it happen.
[18:38.260 --> 18:40.760]  Let's Encrypt launched in December of last year.
[18:42.060 --> 18:49.160]  We've issued... we have four and a half million active certificates covering somewhere north of eight million host names.
[18:49.460 --> 18:51.980]  You know, you could think of a website.
[18:53.620 --> 19:01.980]  And along with Let's Encrypt the Service, the Certificate Authority, we launched Certbot, which is a client for that API.
[19:02.920 --> 19:09.660]  And Vivian mentioned the awesome website that the web development team set up for Certbot.
[19:09.840 --> 19:12.220]  If you haven't checked it out, I highly recommend it.
[19:12.420 --> 19:19.840]  It leads you through exactly what you need to do based on what operating system you have, what server you have, and leads you through the install process.
[19:19.840 --> 19:25.080]  If you're interested in Let's Encrypt, tomorrow morning...
[19:25.080 --> 19:31.600]  Tomorrow afternoon I'll be giving a workshop on integrating Let's Encrypt, writing clients, etc.
[19:32.040 --> 19:36.520]  And Sunday morning I'll be giving a talk on Let's Encrypt progress so far.
[19:37.240 --> 19:43.200]  I also wanted to mention another interesting project, more on the write blog post side.
[19:43.540 --> 20:00.700]  About a year and a half ago we sounded the alarm on Verizon's UIDH header tracking, where they would actually, you know, reach into your packets and edit them and insert this unique header so that sites could use that as a token to identify you and request even more data from Verizon.
[20:01.520 --> 20:06.980]  And it was a tough battle, and there was a lot of twists and turns in it, and it didn't look like Verizon was going to budge.
[20:07.100 --> 20:15.960]  But this year Verizon and the FCC reached an agreement to do exactly what we had asked for, which was to say, this is purely an opt-in feature.
[20:16.180 --> 20:25.420]  It's so invasive to add this tracking header to all of your traffic that you have to affirmatively say, yes, I want this, before they'll start doing that.
[20:25.660 --> 20:28.000]  So I think that was a great victory on that track.
[20:33.620 --> 20:35.380]  And now I think we'll turn it over to questions.
[20:36.210 --> 20:37.040]  Yes, very good.
[20:37.250 --> 20:40.940]  So now this is the portion where we answer your questions.
[20:41.700 --> 20:44.840]  So feel free, there's a microphone there in the center aisle.
[20:45.080 --> 20:49.320]  So we can line up in front of that microphone and we'll take you in order.
[20:50.700 --> 20:55.800]  Just a couple of words before we begin on the question, give people time to get ready.
[20:56.490 --> 21:01.380]  One of the things that we do is we provide legal advice to people about their particular situations.
[21:01.990 --> 21:04.160]  But this is not the time for those questions.
[21:04.400 --> 21:08.520]  You want to have attorney-client privilege when you're asking those questions.
[21:08.520 --> 21:14.780]  So, you know, if you're going to be wondering if what you did is a violation of the law, let's have that be a private conversation.
[21:16.290 --> 21:21.800]  And we will be around here and we can have other conversations over the course of the weekend.
[21:22.140 --> 21:30.160]  But with that said, we look forward to hearing what you have to ask about EFF, our work, and the digital future.
[21:30.340 --> 21:32.210]  So please begin.
[21:32.680 --> 21:33.120]  Thanks.
[21:33.120 --> 21:44.490]  The EFF makes the news an awful lot, usually in cooperation with a lot of other acronyms and people that... stuff that organizations that people are usually more familiar with, like the ACLU.
[21:44.860 --> 21:48.970]  So sometimes I'll point this out and I'll say, well, who the heck is the EFF?
[21:49.340 --> 21:55.360]  So how should we describe the EFF to the non-computer person?
[21:56.440 --> 21:59.040]  Usually I say they're kind of the ACLU of the Internet.
[21:59.040 --> 22:04.440]  But that, I mean, I realize you guys have been around like forever since, you know, since it was cowboy land out there.
[22:06.060 --> 22:09.040]  So how would you like the... what's a good explanation?
[22:09.700 --> 22:13.920]  How do we describe the EFF to the general public who might not be that computer savvy?
[22:14.740 --> 22:19.040]  So if I could start out, you know, we know a bunch of folks at the ACLU.
[22:19.760 --> 22:20.520]  We're fairly close to them.
[22:20.640 --> 22:23.740]  And that is an easy way to describe what we do.
[22:23.860 --> 22:28.000]  But they would definitely say, well, but the ACLU is the ACLU of the Internet.
[22:29.060 --> 22:32.040]  And they do actually have a very strong dot rights program.
[22:32.700 --> 22:37.980]  And they recently filed a lawsuit to challenge the CFAA on the grounds that it makes it difficult...
[22:37.980 --> 22:43.500]  It actually makes it criminal for researchers to try and investigate bias and machine learning algorithms.
[22:44.420 --> 22:49.900]  So, you know, when I describe EFF, I usually say, you know, kind of the specific topic areas we work on.
[22:49.980 --> 22:55.260]  We defend privacy and free speech online and innovation and many, many other things.
[22:55.540 --> 22:56.420]  Parker, you look like it.
[22:56.420 --> 22:56.720]  Yeah.
[22:57.340 --> 22:58.410]  So I...
[22:58.960 --> 23:00.020]  Not to pick on the...
[23:00.020 --> 23:01.560]  Everyone does say ACLU of the Internet.
[23:01.740 --> 23:04.520]  So I've thought about this a lot, not to pick on that phrasing.
[23:04.780 --> 23:08.940]  But the other thing is that a lot of our work doesn't have anything to do with the Internet.
[23:09.500 --> 23:23.960]  Like this 1201 lawsuit, one of the high profile things is that because 1201 creates restrictions around any access control measure on any copyrighted work.
[23:24.100 --> 23:25.440]  This includes embedded software.
[23:26.080 --> 23:31.320]  And so your tractor, if you're a farmer, now has embedded software.
[23:31.700 --> 23:41.260]  And John Deere came to the exemption process and said, no, we don't think there should be an exemption because we don't want people to be able to repair their tractors.
[23:42.100 --> 23:49.940]  And so when it comes to defending people's right to tinker with their tractor, it just doesn't have anything to do with the Internet anymore.
[23:52.500 --> 23:57.920]  And so I like to think that it's all technology, really.
[23:58.040 --> 24:02.680]  That we're making sure your civil liberties survive a collision with technology.
[24:04.040 --> 24:06.700]  And yeah, that sort of covers it.
[24:06.780 --> 24:14.380]  Although, if you're trying to explain it to a non-technical friend, that might not exactly do it for them.
[24:14.860 --> 24:24.400]  But yeah, it really is... even in the five years that I've been there, and certainly in the 26 years that EFF's been around, the border sort of crossed us.
[24:24.520 --> 24:36.040]  And now we work on a lot of issues that used to be... where we used to be niche and for the people in this room, now it's kind of everybody in society is affected by the stuff we work on.
[24:36.940 --> 24:48.260]  Yeah, it's definitely something that my team has been talking about a lot because we would like people to be able to come to EFF.org and instantly understand what we do, which is really hard.
[24:49.040 --> 24:53.960]  I think definitely I would echo what Parker and Jacob said.
[24:54.260 --> 24:57.940]  And also, I found it helpful to talk about the type of work that we do.
[24:58.380 --> 25:06.220]  Because I think the legal work that we do is really helpful to draw a parallel to ACLU.
[25:07.320 --> 25:10.720]  And I think they probably do some activism similar to what your team does.
[25:11.220 --> 25:15.040]  I think also our tech tools are something that people are really excited about.
[25:15.180 --> 25:23.020]  So I'll often talk about, you know, we do this legal work, and we do this on the ground activism, and we also have these awesome tech tools.
[25:23.020 --> 25:28.520]  I do like, I like explaining to your friend, oh yeah, they're a group that sues the government and has a browser extension.
[25:31.640 --> 25:32.240]  All right.
[25:32.560 --> 25:34.720]  Speaking of which, if I can drop in...
[25:34.720 --> 25:35.300]  Is there a next question, or...?
[25:35.300 --> 25:41.240]  Oh, well, I just wanted to mention one of the really cool projects we launched on the tech projects team this year is Privacy Badger.
[25:42.300 --> 25:43.480]  Two browser extensions, sorry.
[25:43.580 --> 25:44.160]  Two browser extensions.
[25:45.160 --> 25:50.440]  And yeah, you can hear all about Privacy Badger, I think, in this room in the session after next time.
[25:51.120 --> 25:52.800]  Anyway, shall we get to the next question, please?
[25:53.340 --> 25:54.680]  Thanks, guys, for doing this panel.
[25:54.800 --> 25:55.400]  This is really interesting.
[25:55.700 --> 26:02.700]  My question was about what's the hardest part about getting like public outcry and public action about things like SOPA.
[26:02.820 --> 26:09.840]  Is it like getting like general news media outlets to pay attention, or is it like getting people to actually call their senators?
[26:10.020 --> 26:11.580]  What's the most difficult part of that process?
[26:13.120 --> 26:15.260]  Well, so with SOPA, it was pretty easy.
[26:16.000 --> 26:17.280]  But generally, yeah.
[26:17.640 --> 26:18.480]  Generally, it's really hard.
[26:19.060 --> 26:23.760]  With the news media, a thing that I... this is like, you know, insider tips.
[26:24.260 --> 26:29.460]  Until you have an image, like the TV won't cover it.
[26:29.760 --> 26:31.280]  And newspapers won't cover it.
[26:31.280 --> 26:47.720]  And so one of the things in retrospect, when we had, you know, Wikipedia blacked out and Google blacked out and these sites like that literally you could take a screenshot of that could be B-roll, that was the thing that launched it up to the next level.
[26:47.720 --> 27:01.380]  But yeah, I think that one of the hardest things is that with a lot of these issues, again, with SOPA, it was so egregious and so poorly packaged, it was just not made to withstand any sort of public scrutiny.
[27:01.600 --> 27:08.560]  It was just supposed to be, you know, shuttled through from, you know, directly from the MPAA through Congress.
[27:10.200 --> 27:14.000]  A lot of times, there is a better public face on it.
[27:14.000 --> 27:15.480]  Or a lot of times, it's not clear.
[27:15.740 --> 27:28.380]  Like, 1201, I do have to say, like, this affects, like, not just mashup films, but also tractors, and also, you know, voting machines, and these, you know, medical devices.
[27:28.840 --> 27:33.940]  And finding that thread and explaining to people what the connection is, is hard.
[27:34.080 --> 27:39.380]  And without that, yeah, getting them to pick up their phone and call for legislative change or whatever it is, is tricky.
[27:39.700 --> 27:41.940]  And Parker, is this a good time to mention the EFA?
[27:43.350 --> 27:44.480]  Yeah, sure.
[27:44.800 --> 28:01.760]  So, one of the ways that we're working on this, and Vivian mentioned before, some of our move to grassroots, to working with local groups, is an alliance of mostly student groups and local groups.
[28:02.260 --> 28:04.820]  The EFA, which is Electronic Frontier Alliance?
[28:04.820 --> 28:05.260]  Yeah.
[28:05.280 --> 28:05.600]  So, okay.
[28:06.200 --> 28:06.300]  Whew.
[28:07.040 --> 28:09.200]  You know, you get up here, and it's...
[28:09.200 --> 28:10.240]  And, yeah.
[28:10.400 --> 28:11.940]  And so, that is really...
[28:11.940 --> 28:12.420]  It's...
[28:12.420 --> 28:18.700]  There's no substitute for talking directly with someone who knows the issues a little better than you do.
[28:19.280 --> 28:22.320]  And so, we're trying to build out that network.
[28:22.460 --> 28:23.240]  And we've been...
[28:23.240 --> 28:30.560]  Already, we've been having some success building out that network of the connected points all over the country, and hopefully all over the world.
[28:31.140 --> 28:41.060]  And there are regular meetings, and we have video calls, and it's definitely something that's working to get that kind of connection.
[28:43.180 --> 28:44.120]  All right, sir.
[28:44.400 --> 28:44.800]  Hi.
[28:46.100 --> 28:54.200]  I believe Vivian was talking about stingrays and license plate readers, which is what my kind of question is about.
[28:54.380 --> 28:59.940]  I understand, basically, how these things are used to target individuals.
[28:59.940 --> 29:15.880]  But I'm just wondering if you guys could talk in whatever level of detail you'd like to, as how, like, the ring of steel that's here in lower Manhattan, where just anybody who goes below a certain street, their license plate is just captured and it's stored for,
[29:15.900 --> 29:17.400]  whatever, three years.
[29:17.640 --> 29:20.900]  Like, how does that not run afoul of the Fourth Amendment?
[29:21.200 --> 29:32.620]  And the same thing with dirt boxes, which is like the super stingray that they put in planes and then just randomly go over neighborhoods, or when there's a protest so they can track movements.
[29:32.620 --> 29:38.420]  And it's like, is there some specific exemption in the Patriot Act that started this and it's just never been challenged legally?
[29:38.500 --> 29:40.840]  How is this legal?
[29:42.800 --> 29:43.700]  How could it be?
[29:44.440 --> 29:49.760]  Well, I can tell you a little bit of where the government stands on this issue.
[29:49.860 --> 29:57.720]  As you might imagine, I don't always agree with them, but I can at least try to explain what their position is on a lot of these technologies.
[29:57.720 --> 30:14.760]  And I put these in sort of the broad category of technologies that take something that previously a police officer could do manually, like they could walk around lower Manhattan with a notepad and write down license plate numbers.
[30:16.660 --> 30:22.680]  And they could follow somebody, they could take a picture of somebody with a camera.
[30:23.600 --> 30:29.320]  And then, in their view, it's multiplication by zero.
[30:29.580 --> 30:46.060]  If it was okay, if there was zero problem with a single person doing it once, then if you did it for everybody, all the time, 24-7, then you've just multiplied by zero, and so you continue to not have a problem with it.
[30:47.020 --> 30:48.720]  And then it starts to get more ubiquitous.
[30:49.940 --> 30:54.500]  So with stingrays, well, these things are just traveling off the airways, and there we are.
[30:54.740 --> 30:57.220]  We're just checking out what's on the airways.
[30:57.260 --> 30:58.140]  What's the problem with that?
[30:59.260 --> 31:10.400]  And I think that the Supreme Court has actually had a couple of decisions which have, well, they've been promising, but they haven't resolved the issues.
[31:10.640 --> 31:17.080]  And, for example, there was a decision concerning tracking somebody who was using a GPS tracker.
[31:19.240 --> 31:21.620]  And, you know, the government made these arguments as well.
[31:21.760 --> 31:27.720]  It's okay to track this person with a GPS tracker because, you know, we could send someone to follow them.
[31:27.840 --> 31:32.060]  And it doesn't matter that there was previously a practical limitation of what we can do.
[31:32.160 --> 31:37.260]  We should be able to take all the advantage of new technologies to use them to the maximum effect.
[31:37.980 --> 31:42.300]  And during the argument there, the justices were somewhat incredulous in this.
[31:42.300 --> 31:53.660]  They were like, so you're trying to tell me that if you just wanted to follow me, you know, to track me, put a GPS tracker on my car wherever I go, you could do that and no warrant would be required, no court order.
[31:54.060 --> 31:55.020]  You could just do that.
[31:55.080 --> 31:56.880]  And they had to say, well, yes, right?
[31:57.480 --> 31:58.580]  That was their position.
[31:59.850 --> 32:04.080]  And, well, the decision came out that that was a problem in that case.
[32:06.630 --> 32:11.540]  And it was a convoluted case, so there were different opinions on it.
[32:11.540 --> 32:15.060]  But it set the stage, I think, for further challenges.
[32:15.240 --> 32:26.660]  As the courts were starting to recognize that when you take things at scale, you make them ubiquitous, they do it all the time, you have a different set of societal problems.
[32:26.960 --> 32:36.680]  And that we shouldn't change the world that we're living in to one more of a dystopian surveillance state just because the technology for doing so is super cheap.
[32:38.760 --> 32:44.780]  I also want to just add one quick thing, which is if the question broadly was, how is this legal?
[32:45.900 --> 32:47.720]  Against groups, not just individuals.
[32:47.980 --> 32:48.260]  Yeah.
[32:48.680 --> 32:52.380]  I think sometimes it's not.
[32:52.620 --> 32:54.160]  And that's, you know, and then we sue.
[32:54.340 --> 32:58.080]  And so just because the government is doing it doesn't...
[32:58.080 --> 33:00.460]  I think that they would say that makes it legal.
[33:00.720 --> 33:02.500]  That's how we decide what to do.
[33:02.900 --> 33:03.300]  Yeah.
[33:03.460 --> 33:03.780]  Yeah.
[33:03.860 --> 33:07.420]  To be very clear exactly, I was explaining what the government's position is.
[33:07.520 --> 33:10.980]  And I think that we have continued to challenge some of these things.
[33:12.190 --> 33:23.440]  And not only on the Fourth Amendment, which you mentioned, for requiring reasonable searches and warrants and such, but also under the right of association.
[33:23.700 --> 33:26.860]  That it's been long established that you have the right to associate with people.
[33:27.440 --> 33:31.300]  And you can do so without the government knowing who you're associating with.
[33:31.900 --> 33:34.520]  And some of these technologies actually make that very difficult to do.
[33:35.980 --> 33:38.500]  And subject challenge under that amendment, under the First Amendment.
[33:38.780 --> 33:42.580]  And to maybe answer a little of the underlying question of how do we stop this.
[33:42.880 --> 33:48.700]  There was another really good talk panel earlier about police use of surveillance techniques.
[33:48.700 --> 33:59.020]  And they raised the point that it's much, much easier to stop new surveillance technologies from entering into your local police department's arsenal before it happens.
[33:59.360 --> 34:09.260]  You know, if you can spot this at the town council level or figure out that your local police are going to start doing this, it's much easier to fight it there than after it's already deployed, trying to get it rolled back.
[34:09.260 --> 34:22.180]  And so this is a great opportunity for sort of grassroots activism, keeping an eye on town meeting minutes, filing FOIA requests, and finding out what police departments are doing and trying to stop new surveillance activities before they start.
[34:24.060 --> 34:42.320]  On the same thread of 100% spying on us 100% of the time, 100% of the locations we go, is there... I think everybody in the room here is concerned about that, but the general public who has, quote, nothing to hide, end quote, is not because they truly believe that they have nothing to hide.
[34:42.540 --> 34:50.820]  And so how do you bring to their emotion, to them, the emotion that is important to stop this politically?
[34:53.600 --> 34:54.080]  Sure.
[34:54.660 --> 34:59.840]  So this has been a notion that's been around for a long, you know, nothing to fear, you have nothing to hide.
[34:59.840 --> 35:06.280]  And I think that as like a threshold level that, for the most part, people do have something to hide.
[35:06.460 --> 35:19.280]  They may not be thinking of it right away or they may think basically the hidden assumption under the nothing to hide is that the current set of government is just fine and I'm not too worried about them.
[35:20.060 --> 35:24.020]  But if that government changes, maybe you do start to have something to hide.
[35:24.960 --> 35:36.140]  And we've seen, you know, all around the world there have been circumstances where governments have changed in their character rather suddenly and then the tools of the surveillance state are now available to people that you don't agree with.
[35:36.260 --> 35:48.780]  And we saw that here where there was an interesting shift in who likes surveillance and who didn't like surveillance when the warrantless surveillance program shifted from the Bush administration to the Obama administration.
[35:49.260 --> 35:51.940]  Some people shifted their views about whether it was a good idea.
[35:51.940 --> 36:03.260]  I want to say is actually whether it's a good idea as a matter of civic hygiene, that you don't want to have the tools of the surveillance state available even if right now you don't feel like you have something to hide.
[36:03.440 --> 36:04.180]  But that's all right.
[36:04.280 --> 36:07.220]  Even if you find people who's like, no, seriously, I have nothing to hide.
[36:07.780 --> 36:10.380]  I am the most honorable person you would ever imagine.
[36:11.820 --> 36:13.440]  You know, okay, maybe that's true.
[36:13.580 --> 36:15.000]  Maybe you are wonderful.
[36:15.740 --> 36:21.080]  But you have an advantage in society when other people are able to hide things.
[36:21.240 --> 36:30.680]  When a source is able to talk to a reporter and give information, whistleblowers can come forward without having to fear retribution for their whistleblowing.
[36:30.940 --> 36:37.760]  The fact that other people have privacy from surveillance benefits society and allows us to have a more open democracy.
[36:38.220 --> 36:45.460]  So it's not just about yourself and whether you have something to hide, but what kind of future we want to have and what kind of society we want to live in.
[36:47.180 --> 36:55.260]  So, I'd like to invent maybe a sort of corollary to Schneier's Law, which is that anybody can invent a crypto system so good that they can't break it.
[36:55.420 --> 36:59.360]  But you need to invent a crypto system so good that someone else can't break it and that's much harder.
[37:00.000 --> 37:04.040]  Similarly, anyone can live a life such that they can't think of anything that they have to hide.
[37:04.040 --> 37:09.000]  But living a life such that the government can't find anything that you have to hide is much harder.
[37:10.840 --> 37:13.080]  And I also want to push back a little bit.
[37:14.020 --> 37:21.840]  People outside of this room, even outside of the other rooms, do care about this.
[37:21.840 --> 37:24.860]  And sometimes they don't always know that what they care about is privacy.
[37:25.180 --> 37:31.240]  But they do care about their right to associate and they care about freedom of speech.
[37:31.460 --> 37:40.520]  Even if they don't... the Snowdenism is not caring about privacy because you have nothing to hide is like not caring about freedom of speech because you have nothing to say.
[37:42.300 --> 37:44.600]  But, you know, people do care.
[37:44.780 --> 37:46.520]  And they actually do connect to this.
[37:46.640 --> 37:58.860]  And if you look at, you know, I don't want to lean too heavily on this, but there are polls out there that suggest that a lot of people care about issues that we consider privacy issues.
[37:58.860 --> 38:05.180]  So there's a temptation to write that off and go into privacy nihilism mode.
[38:06.200 --> 38:14.300]  But this is something that people, even outside the hacker community, care about and are paying attention to.
[38:16.120 --> 38:36.260]  So now that we're starting to reach a point where privacy issues are actually cutting into the bottom line of the industry's interests, have you seen corporations, have they been willing to lobby on behalf of these issues?
[38:36.680 --> 38:40.220]  And does the EFF itself engage in lobbying?
[38:40.560 --> 38:53.520]  And lastly, do you think that we could see a reality where Fourth Amendment issues becomes the same kind of third rail political issue that Second Amendment issues are for politicians?
[38:54.480 --> 38:55.240]  All right.
[38:55.480 --> 38:57.340]  So a number of questions there.
[38:59.020 --> 39:07.900]  So I guess I'll hit on one of those, which is you asked about does EFF lobby and do the corporation lobby?
[39:08.080 --> 39:10.300]  So EFF does a little bit of lobbying.
[39:10.520 --> 39:20.600]  As a non-profit organization, a 501c3, there are actually limits on how much lobbying we can do and maintain our non-profit status.
[39:21.220 --> 39:22.540]  So we do some.
[39:23.040 --> 39:25.660]  And it's mostly in the form of grassroots lobbying.
[39:26.240 --> 39:33.200]  Vivian was mentioning our action center, and that is a way that people can go and reach out to their representatives.
[39:34.100 --> 39:37.800]  And then, did you work on the Democracy Tools project at all?
[39:37.940 --> 39:38.500]  Do you remember that one?
[39:38.600 --> 39:40.000]  I do, but I haven't worked on it.
[39:40.040 --> 39:40.220]  All right.
[39:40.280 --> 39:42.580]  Will you explain what Democracy Tools are?
[39:45.260 --> 39:52.280]  Democracy Tools is another site that basically allows other people to set up something for contacting their representatives.
[39:52.500 --> 39:56.420]  So this is sort of more enabling others to do this.
[39:58.840 --> 40:03.640]  Well, I guess you can use them for whatever you want, but hopefully they'll be in the right direction.
[40:03.940 --> 40:12.320]  And then with respect to the companies, we've seen actually several of the companies get active.
[40:13.060 --> 40:22.100]  I mean, Apple has been very vocal on no back doors, standing up to a lot of government pressure to put back doors into their encryption.
[40:22.100 --> 40:39.600]  And during the NSA surveillance, after the Snowden leaks really brought a lot of things into the public consciousness, a group of companies were pushing back heavily against the surveillance.
[40:40.340 --> 40:45.620]  There was a group of major companies like Apple and Facebook and Google that formed a coalition.
[40:45.880 --> 40:48.680]  They took out a full-page ad in, I think it was the Washington Post.
[40:49.560 --> 40:52.500]  So, there has been some activity.
[40:53.460 --> 41:00.060]  You can find a lot more widespread agreement among corporations that there should be strong limits on government surveillance.
[41:01.080 --> 41:04.720]  And perhaps less so on limits on what corporations can do.
[41:08.170 --> 41:08.910]  Oh boy.
[41:09.130 --> 41:14.750]  And the other question about the Fourth Amendment being like the Second Amendment in terms of the Third Rail.
[41:14.930 --> 41:16.050]  Yeah, that would be nice, wouldn't it?
[41:18.250 --> 41:19.030]  I don't know.
[41:19.310 --> 41:23.210]  I think, you know, it is on a lot of the issues that we work on.
[41:23.330 --> 41:24.950]  I think the First Amendment is kind of like this too.
[41:27.330 --> 41:29.870]  People, a lot of people care about it a little.
[41:30.330 --> 41:39.930]  Like there's a lot of people who you can do something that they'll find creepy, or you can restrict their speech in a way that they won't like, but it doesn't happen that often to them.
[41:39.930 --> 41:50.230]  And so it's rarely a group of people's number one issue in the way that I think gun ownership is for a lot of people.
[41:50.350 --> 41:56.210]  Or at least the NRA has done a really good job of giving the impression that that's the case.
[41:57.010 --> 42:09.470]  And, you know, I think it will bubble up people's priority list as more and more of our lives are lived online and around technology.
[42:10.010 --> 42:15.250]  Abuses of that technology are going to be more and more important to people.
[42:15.250 --> 42:25.550]  And when it becomes someone's top priority or tens of thousands or hundreds of thousands or millions of people's top priority, then yeah, it does get to be a political third rail and we can only hope.
[42:25.770 --> 42:30.150]  I have heard, by the way, on the Hill that when...
[42:30.150 --> 42:36.530]  So they've been talking about new copyright legislation basically since SOPA was defeated.
[42:36.950 --> 42:41.610]  And they say, they use a phrase like, oh, we can't do that, it would get SOPA'd.
[42:43.110 --> 42:50.810]  And so I do like, you know, I think a show of force every once in a while does remind them that like, oh, yeah, we...
[42:51.410 --> 42:52.950]  There are voters out there.
[42:54.470 --> 42:57.890]  And if you piss them off, it's not good for the next election.
[42:58.890 --> 43:02.730]  So, yeah, I think that we get there in bits and pieces.
[43:04.490 --> 43:10.470]  And, you know, it doesn't have to be people's top issue for it to be something that EFF can rally people around.
[43:10.470 --> 43:12.150]  And I think that's an important part of our role.
[43:12.530 --> 43:19.430]  Unfortunately, in this country, I think for it to reach critical mass, it usually has to end up being about commerce.
[43:19.870 --> 43:33.670]  So, you know, I would hope that we could kind of get that momentum around commerce the way the NRA has done, where they've kind of put together their grassroots activists with the manufacturing base.
[43:34.950 --> 43:38.930]  And, you know, whether you like what they've done or not, I think it's been a successful model.
[43:39.310 --> 43:39.830]  Thank you.
[43:40.010 --> 43:40.370]  Yeah, thank you.
[43:40.530 --> 43:40.970]  Thank you.
[43:44.980 --> 43:45.980]  Hello, all of you.
[43:46.160 --> 43:47.260]  Thank you for doing what you do.
[43:47.340 --> 43:49.440]  And thanks for a really great discussion today.
[43:50.420 --> 43:54.100]  My question is DRM versus GPL.
[43:54.100 --> 43:55.760]  I'm just curious about some comments.
[43:56.020 --> 44:01.480]  I know some people who really love the GPL, both version 2 and version 3.
[44:01.680 --> 44:05.140]  And I know those same people also really love the Apple store.
[44:05.700 --> 44:14.100]  So the question is why can't we or maybe we can put GPL code in the app store?
[44:14.100 --> 44:17.780]  I think if you read the Apple fine print carefully, they don't care.
[44:18.260 --> 44:24.060]  In fact, if you read to the end, they even say, hey, if you don't like our license, replace it with one that you like.
[44:24.640 --> 44:30.760]  So, but it seems like they do get upset when a community posts code and there's internal disagreement in that community.
[44:31.100 --> 44:31.940]  So that's one thing.
[44:32.640 --> 44:34.340]  And this is a little ramble on question.
[44:34.500 --> 44:37.400]  I'm partially asking this to help formulate the right question.
[44:37.660 --> 44:42.420]  But the other comment is it seems like the GPL in some ways is out of date.
[44:42.420 --> 44:48.580]  And it may be controversial, but it was built in a world where we had desktops and source didn't move very freely.
[44:49.220 --> 44:50.420]  Whereas now source is everywhere.
[44:50.740 --> 44:58.540]  We have, you know, GitHub, any number of ways to distribute the source explicitly or surreptitiously.
[44:58.900 --> 45:05.760]  So if something's under DRM, that's not going to limit people's ability to examine or use that source.
[45:05.980 --> 45:07.460]  So back to the first question.
[45:07.680 --> 45:08.740]  What do you think?
[45:08.840 --> 45:11.760]  Is it okay to put GPL code in the app store?
[45:12.860 --> 45:17.060]  I super love being in a room where you can ask about DRM v GPL.
[45:17.400 --> 45:18.120]  And people are like, yeah.
[45:19.100 --> 45:19.420]  Yeah.
[45:19.680 --> 45:20.440]  I know what you mean.
[45:21.020 --> 45:22.500]  It doesn't happen to me that often.
[45:24.540 --> 45:26.920]  Can you put GPL code in the app store?
[45:27.060 --> 45:27.640]  I mean, people do.
[45:29.460 --> 45:37.380]  I haven't looked at the app store agreement recently enough or closely enough to, like, come to a conclusion on that.
[45:38.240 --> 45:39.800]  You know, we ended up not...
[45:39.800 --> 45:40.920]  EFF has an app.
[45:41.020 --> 45:46.560]  We didn't put it in the app store because we had some issues with how that agreement was.
[45:46.700 --> 45:52.640]  So we chose not to do the agreement with Apple that would require it if you want to use the app store.
[45:53.100 --> 46:03.900]  So it's possible that some of the GPL projects also have concerns about just the agreement you have to have with Apple as opposed to the agreement that you would end up having with your end users.
[46:04.740 --> 46:05.880]  But I don't know.
[46:06.140 --> 46:15.180]  Well, also, you know, for fear of stating the obvious, you know, the pernicious part of DRM in the app store is not so much that it prevents you from reverse engineering your app.
[46:15.300 --> 46:17.260]  You know, the source might be provided through another channel.
[46:17.460 --> 46:22.660]  The pernicious part is that Apple gets to choose what apps you're allowed to run on your phone and which apps you're not.
[46:22.860 --> 46:28.200]  And so it's sort of the DRM built into the iPhone inherently that only allows you to run apps from the app store.
[46:29.520 --> 46:30.040]  Sure.
[46:30.040 --> 46:30.920]  I think that's very important.
[46:31.100 --> 46:36.160]  I would see that as a separate issue that requires its own adjudication, but also very, very important.
[46:38.020 --> 46:43.300]  And, yeah, in terms of the updating, you know, that's an FSF question.
[46:44.360 --> 46:51.940]  And I do think, you know, they've given thought to that and we could have a long conversation.
[46:52.020 --> 46:53.340]  This actually probably...
[46:53.340 --> 46:57.200]  I think we're having a sort of happy hour thing later.
[46:57.840 --> 46:58.280]  Nice.
[46:58.280 --> 47:01.160]  Maybe find me and I'll rant to you about the GPL there.
[47:02.020 --> 47:06.040]  One last teaser thought and maybe we start some discussion outside of this panel.
[47:07.240 --> 47:10.480]  One of the things that I'm concerned about is this notion of a terminal binary.
[47:10.740 --> 47:13.140]  A binary that cannot reproduce itself.
[47:13.360 --> 47:17.640]  So really that means you've removed it so far from the source that... or you've changed it in some way.
[47:18.120 --> 47:19.220]  Whether that's even possible.
[47:19.420 --> 47:19.700]  I sort...
[47:19.700 --> 47:22.840]  I guess you see that with the app store, you put something there, but you can never...
[47:23.420 --> 47:24.260]  You can never...
[47:24.260 --> 47:25.800]  You can't download it and then modify it.
[47:25.860 --> 47:26.740]  You have to replace it.
[47:27.100 --> 47:30.140]  So what the app store represents is this collection of terminal binaries.
[47:31.140 --> 47:33.240]  But at the same time, they could be attached with source code.
[47:34.300 --> 47:35.060]  Anyways, just...
[47:35.060 --> 47:39.420]  There's a large community that's interested in this and just trying to weigh the balance.
[47:39.560 --> 47:40.060]  Thank you very much.
[47:40.140 --> 47:40.580]  Thank you.
[47:40.680 --> 47:42.560]  Also, just to balance off Parker's comment a bit.
[47:42.700 --> 47:46.660]  If you're interested in the EFF speakeasy, come to the booth downstairs for details.
[47:46.660 --> 47:48.000]  Yeah, that's what I was...
[47:48.000 --> 47:48.680]  The speakeasy.
[47:48.880 --> 47:49.080]  Yeah.
[47:49.340 --> 47:50.140]  That's what I was looking for.
[47:50.860 --> 47:51.520]  Hi there.
[47:52.240 --> 47:53.960]  Really great and important work.
[47:54.160 --> 47:56.940]  My question on the heels of this is a bit more banal.
[47:58.520 --> 48:07.180]  On Amazon, smile.amazon.com, EFF is one of the non-profits you can choose to donate money to.
[48:07.340 --> 48:09.020]  Do you actually make money from that?
[48:09.180 --> 48:10.180]  Is that helping you?
[48:10.620 --> 48:11.360]  I mean, some.
[48:11.580 --> 48:12.840]  Yeah, we get a little bit from that.
[48:13.360 --> 48:13.820]  Definitely do.
[48:13.820 --> 48:14.300]  And that's...
[48:14.300 --> 48:14.420]  Yeah.
[48:14.680 --> 48:15.680]  It's like a...
[48:15.680 --> 48:18.680]  They give one percent, I think, to the charity that you pick.
[48:19.180 --> 48:19.900]  Is it half?
[48:20.140 --> 48:20.340]  Yeah.
[48:20.580 --> 48:21.000]  Half a percent.
[48:21.220 --> 48:21.420]  Yeah.
[48:21.540 --> 48:22.020]  And we do...
[48:22.020 --> 48:24.840]  I have actually heard that we see, like...
[48:25.800 --> 48:26.200]  Dollars.
[48:26.200 --> 48:26.900]  I mean, it's not gonna...
[48:26.900 --> 48:27.020]  Dollars.
[48:27.160 --> 48:28.080]  It's not gonna make the budget.
[48:28.980 --> 48:31.860]  But, you know, it's better than nothing.
[48:32.900 --> 48:38.020]  But if you're interested in helping EFF, one of the great ways to do so is becoming a member.
[48:38.020 --> 48:50.820]  Because in addition to donating some money, which helps us, you know, do our operations, it is very useful when we're going to Congress to say, you know, we support this issue, we oppose this issue.
[48:51.320 --> 49:01.240]  When we're filing a brief before a court saying that we're, you know, good spokespeople on this issue, to say how many members we have and have that number be large.
[49:01.240 --> 49:07.040]  So, please, if you have some moment, go downstairs, become a member of EFF.
[49:07.320 --> 49:10.100]  You can do it for a wide variety of donation levels.
[49:11.560 --> 49:15.640]  And getting a higher number of members is very helpful to doing our mission.
[49:17.480 --> 49:18.000]  Hi.
[49:19.300 --> 49:23.560]  Thank you guys for actually existing in our lives.
[49:24.380 --> 49:24.900]  Because...
[49:24.900 --> 49:30.140]  ...many of us are clueless of what we wouldn't do without you.
[49:33.240 --> 49:34.120]  Thank you.
[49:34.120 --> 49:45.160]  My question that needs real clarification for the room, however, is a word that gets thrown around a lot in society.
[49:45.960 --> 49:50.520]  Would you please tell us the definition of privacy?
[49:52.240 --> 49:53.340]  Thank you.
[49:54.500 --> 49:55.380]  And...
[49:55.380 --> 49:58.060]  Well, I think a lot of people might have different definitions of it.
[49:58.060 --> 50:02.880]  One of the definitions that I like, it's actually been around for a long time.
[50:03.040 --> 50:08.260]  It came from an article about privacy, I think, almost, but not quite a hundred years ago.
[50:08.440 --> 50:10.080]  But it's the right to be left alone.
[50:11.520 --> 50:19.720]  That it's not just about keeping things secret, but having someone not be in your business.
[50:20.760 --> 50:23.260]  And, you know, there's other views of privacy.
[50:23.400 --> 50:29.800]  I mean, you can achieve privacy by, you know, going off and living in a cabin in the woods with off the grid and no correction.
[50:30.860 --> 50:31.880]  And maybe that is privacy.
[50:31.880 --> 50:32.720]  It's not legal advice.
[50:33.960 --> 50:34.440]  Right.
[50:37.680 --> 50:40.480]  But that is only one form of privacy.
[50:40.880 --> 50:54.840]  And people also want to have a form of privacy where they get to have some choices in whether their information is shared, that it can go to their friends, but not be shared to the entire world or to the government.
[50:56.020 --> 51:00.420]  So it's a little bit as well about control of your personal information.
[51:00.780 --> 51:07.820]  Yeah, I think, for me, there's a piece of it that has to do with consent, too, that I'm really interested in.
[51:09.100 --> 51:14.840]  Where, you know, sort of speaking to the point of people who don't feel like it's important to them.
[51:14.960 --> 51:20.780]  And I think we named a lot of ways where maybe it is in ways that aren't immediately obvious.
[51:21.040 --> 51:27.000]  But I think that there's also a piece where you should be free to choose.
[51:27.000 --> 51:33.200]  You know, even if there's information that you're comfortable sharing, I think there's a piece of it where...
[51:33.900 --> 51:39.700]  There's like a loss of control that people experience when they don't get to choose.
[51:40.040 --> 51:46.800]  And some people feel like, well, you know, I just don't really think this is up to me anymore, what people know about me.
[51:46.940 --> 51:50.620]  And holding that control is something that I'm interested in.
[51:50.620 --> 51:57.220]  And I think, you know, the fact that it's so hard to define speaks to a deeper issue that privacy is a very abstract ideal.
[51:57.540 --> 52:01.420]  And it's hard to get people fired up about because it's so abstract.
[52:02.780 --> 52:07.500]  And I think that's a challenge we face in activism in our particular communities.
[52:07.820 --> 52:12.320]  Finding better ways and more specific ways to frame very specific problems we're talking about.
[52:12.320 --> 52:21.720]  You know, instead of privacy, maybe say Fourth Amendment violations or say, you know, non-consensual web tracking, which is how we talk about it with Privacy Badger, or say security.
[52:22.180 --> 52:32.960]  You know, I think the enemies of encryption would like to say, well, there's privacy on the one hand and there's security on the other, but they're the same and you need one to provide the other and vice versa.
[52:33.740 --> 52:38.360]  And so I think when we talk about those more concrete ideas, it's easier for people to get excited about them.
[52:40.160 --> 52:40.960]  All right.
[52:42.200 --> 52:42.700]  Hello.
[52:43.540 --> 52:53.900]  My question is about the Let's Encrypt, sort of specifically the certificate error when your mail server is running Let's Encrypt and you open your mail client and you get the certificate error.
[52:54.140 --> 53:00.860]  And more generally, if, you know, the future of is there still, like, work being done, is that going to keep going into...
[53:00.860 --> 53:01.860]  Yeah, absolutely.
[53:02.160 --> 53:07.120]  So, I would love to help diagnose your certificate error.
[53:07.720 --> 53:10.680]  Either at the speakeasy tonight or possibly at the workshop tomorrow.
[53:11.060 --> 53:15.340]  I think, you know, it would require a bunch of back and forth that's not necessarily applicable to everybody.
[53:16.900 --> 53:19.500]  There's definitely a lot more work going on in Let's Encrypt.
[53:20.540 --> 53:26.420]  So, EFF and Mozilla came together with some sponsors to create an independent long-running organization to maintain it.
[53:26.660 --> 53:29.240]  I'm still doing work for EFF on it.
[53:29.380 --> 53:31.220]  We still have a very active certbot team.
[53:31.220 --> 53:34.400]  So, some of the most important work there is scaling it out.
[53:34.900 --> 53:37.940]  I said, we have four and a half million certs now.
[53:38.500 --> 53:44.180]  My talk on Sunday is titled The Next Billion Certificates, which is how many we're going to have to issue to encrypt the whole web.
[53:44.380 --> 53:47.780]  So, you can see there's a big gap between now and then.
[53:48.500 --> 53:53.300]  And also in the certbot world, we're always trying to make it easier and faster and work better for more situations.
[53:54.900 --> 53:56.460]  Okay, we have one more minute.
[53:56.760 --> 53:59.260]  I think we try to lightning round the very last question.
[53:59.460 --> 53:59.680]  All right.
[54:00.320 --> 54:00.840]  And I'm sorry.
[54:01.120 --> 54:02.200]  Yeah, come and fight.
[54:02.320 --> 54:02.980]  We'll be at the booth.
[54:03.680 --> 54:04.140]  Sorry about that.
[54:04.140 --> 54:05.060]  Hi, I'm Lynn Ulbricht.
[54:05.200 --> 54:08.000]  My son is Ross Ulbricht, the defendant in the Silk Road case.
[54:08.340 --> 54:10.800]  And you guys actually wrote a...
[54:11.720 --> 54:12.420]  I'll take it.
[54:12.600 --> 54:12.980]  I'll take it.
[54:13.460 --> 54:14.080]  Thank you.
[54:17.440 --> 54:18.340]  Thank you.
[54:18.340 --> 54:18.360]  Thank you.
[54:19.140 --> 54:27.800]  You guys wrote... supported an amicus brief about the general warrants that were used for his laptop and social media.
[54:28.220 --> 54:34.700]  And because it didn't... it was unconstitutional because there was no particularity, which is part of the Fourth Amendment.
[54:36.740 --> 54:47.000]  So, what... in a couple of cases now, and they did it in the response to Ross's appeal, they say, well, it doesn't really matter if the warrant is constitutional because we did it in good faith.
[54:47.540 --> 54:48.980]  They're using a good faith argument.
[54:48.980 --> 54:51.020]  It's being upheld by the courts.
[54:51.520 --> 54:55.780]  And, you know, I'm like, well, okay, so if I get stopped by a cop for speeding, I can just say, well, hey, it was in good faith.
[54:56.960 --> 54:58.840]  Or if I'm running a website, in good faith.
[54:59.520 --> 55:03.700]  So, in any case, I just wondered about your comments because I'm concerned about it.
[55:03.700 --> 55:07.780]  But it seems like it's, you know, the Fourth Amendment's really in trouble.
[55:08.400 --> 55:11.660]  And so, yeah, this is a challenge.
[55:12.640 --> 55:18.200]  That, you know, courts, a lot of the judges come from the background of being a prosecutor.
[55:18.520 --> 55:23.720]  They are of a starting point of being sympathetic to prosecutions.
[55:24.280 --> 55:26.040]  And sometimes they will say something.
[55:26.220 --> 55:31.940]  There are a number of actually doctrines along these lines that say, well, you know, maybe you shouldn't have done that.
[55:31.940 --> 55:33.880]  But it's fine.
[55:34.680 --> 55:38.260]  And, you know, they acted in good faith.
[55:39.360 --> 55:41.440]  That there's harmless error.
[55:41.660 --> 55:43.420]  We would have found, you know, inevitable discovery.
[55:43.420 --> 55:44.580]  We would have found this anyway.
[55:45.560 --> 55:50.420]  And this is a tendency you can find in courts.
[55:50.600 --> 55:54.640]  Though I think there's been some pushback.
[55:54.640 --> 56:04.640]  I mean, one of the things that I think has been good over the last several years has been the Supreme Court has been looking more critically at some of these things.
[56:04.820 --> 56:17.140]  You know, there was some commentary in a couple of cases sort of like where the court was recognizing, look, you know, if you got rid of the, you know, exclusionary rule, yeah, you catch a lot more people.
[56:17.140 --> 56:19.420]  But there's something more important going on here.
[56:19.540 --> 56:21.640]  It's not just about the maximum effectiveness.
[56:22.180 --> 56:24.420]  I think we are very much running out of time.
[56:24.600 --> 56:26.000]  Thank you so much for that question.
[56:26.380 --> 56:27.420]  Thank you so much.
[56:27.860 --> 56:28.540]  All right.
[56:28.700 --> 56:29.480]  Thank you, everybody.
[56:29.900 --> 56:37.940]  We're going to be down at the booth downstairs and then come down there to find out about our speakeasy tonight.
[56:37.940 --> 56:40.180]  And thank you so much for coming.
[56:40.360 --> 56:40.940]  Thank you.
[56:40.960 --> 56:41.460]  Thank you.
[56:41.820 --> 56:42.140]  Thank you.
[56:42.340 --> 56:42.860]  You're...
[56:42.860 --> 56:43.700]  Thank you.
[56:44.200 --> 56:44.960]  Thank you.