Cindy Cohn: Privacy’s Defender

Welcome to Talk of the Bay on Case Grid. I'm Rachel Ann Goodman, and my guest Cindy Cohn is

author of a legal memoir, but really it's bigger than that. Privacies defender, my 30-year fight

against digital surveillance out on MIT Press. Her national book tour will be bringing her to UC

Santa Cruz on Tuesday, May 19th. So if you're intrigued by this interview, you can go see her in person.

Cindy is stepping down as executive director of the Electronic Frontier Foundation in a few months

after 26 years with the organization. She has spent her whole career challenging the politicians

and corporations that relentlessly try to peer into our daily lives right up to the lawsuits

they filed against the government in the past year. We'll be talking about the current environment

of surveillance, capitalism, and all the different ways in which Cindy has fought for your right

not to be surveilled. Cindy, welcome to the program. Oh, thank you. And thank you for that kind

of introduction. Absolutely. Well, I'm going to start with a question I know are Santa Cruz listeners

will appreciate what is the connection between your career as a litigator for privacy as a fearless

lawyer fighting for our rights and your love of the grateful dad.

Well, look, my love of the grateful dad came from a feeling that I didn't quite fit in where I

came from. And, you know, the dad have always welcomed the misfits of the world, the people who

don't quite fit in where they came from. So I think that, you know, my passion for privacy is about

ways in which people who have less power can have protection against people who have more power.

And I think there's something in the dead community that really speaks to that. And also,

you know, having the freedom to chart your own course, right? And I think that's embedded in the

music and the scene. And so that all happened and that's certainly true. And then this other

thing happened, which is of course the organization that I've been a part of for the last 26 years

was founded by John Perry Barlow, who he always would call himself the junior varsity lyricist

for the grateful dad. And so, you know, in addition to it being something I was interested in,

you know, EFF was really founded by somebody who had, you know, deep, deep connection to the

dead community. Now that was kind of a happy accident. But it did kind of make me feel a little

like when I started hanging out with all of these hacker types that like I had something in common

with at least, you know, one of the more prominent ones in Barlow. I didn't realize the connection

between the song Cassidy and him. So that was great to read about that. Well, let's start at the

present moment and then we'll look backwards because memoirs do that, but you also tie it into the

present moment. My favorite guy when I was a kid, Mr. Rogers said, look for the helpers, right?

So in fighting for our privacy on the internet, do we have enough helpers right now to help save us

from this incredibly stepped up surveillance that's happening where, you know, Doge looked into

our data and who knows what all put it in the cloud somewhere where anybody could find it.

I know there's class actions lawsuits going on. It seemed like the only backstop to Trump 2.0

are lawyers and judges and you spend a lot of time in your book talking about that dynamic.

Yeah, I mean, the short answer question to your question is we potentially have enough people to

fight back, but we need a part of the reason to write the book is to help people feel empowered

that they can as well. Regardless of whether they're lawyers or technologists, there is a place

to help join in the fight to protect privacy. And again, I really maintain that privacy is

one of the core things we need in order to have a self governing or society. So I think that the

standing up for privacy is actually standing up for the future of the Republic and self-government.

So do we have enough people? I think theoretically we have enough people and part of my job with

this book I hope and the work that I've done is to try to help people feel like they can be a part

of these fights and indeed that they ought to be and also that it's fun. It's not like something

you do that's treacherous. There's actually a lot of fun in standing up for what's right. So I tried

to bring that as well, but you're right that right now it can feel really overwhelming.

There, there, you know, the surveillance is not just the business model placing ads for us.

It's in everything we do the way that behavioral ads and other things are now feeding

into the government, feeding into the surveillance state, and increasingly that same

360 degree surveillance as being marshaled in ways that are really contrary to our interests,

whether that's deciding how much you pay for things based upon what the other things they know

about you to be able to do what economists call price discrimination. I recently saw an article

where employers are looking at, you know, information about prospective employees to decide how

little you're willing to be paid based on how desperate you are for a job. So this surveillance is

and then of course we know that the surveillance information is being used by ICE to decide whether

they're going to target the rates on us and our neighbors. It's being used in all sorts of very

direct ways by the government as well. So we built ourselves quite a bit of a pickle we built.

We got trapped into quite a bit of a pickle. It's not going to be something that we get out of

right away. And it really can be quite, yeah, I called it a pickle, but this really can be

quite dangerous for for people. And so there's a lot to do. It's, it's an important time

because the stakes are higher than ever. We just read a headline today. I just read the headline.

Trump administration is reportedly preparing an executive order that would require banks to

collect citizenship data for new and existing customers. My rhyme reaction is people are going

to flood to the credit unions or anybody that will promise them a place that won't do that, right?

Can they can even require banks like what rule over private banks do the government actually

even have? They have some pretty powerful tools around the banking industry and around things

like that. It's actually a place where we have not done enough to shore up privacy, financial

privacy. And so I'd have to look at, you know, I'm a lawyer at the bottom of the, I have to look

at the specific order. And like, it depends is the standard answer. But I would not rule it out

as something that they can do, given the ways in which, especially in the last 20 years,

we have increasingly given the government the authority to require information from us

undergrounds of fighting terrorism or fighting crime or fighting other things. And banking has been

one of those areas where we've seen a really stepped up effort to use surveillance and data

collection and data analysis as a mechanism. So I don't know what to see what it looks like, but

I would not rule it out. Of course, there will be a fight. And there, you know, the good news is

there is a huge failings of people, both lawyers and non lawyers who are pushing back every time

this happens, you know, really thank your local union members. A lot of these fights while the

lawyers are, are, are, you know, the tip of the spear. It's because of the, you know, government

employee unions and teachers unions and other unions that are doing a lot of this and private,

private individuals too. So lots of people are standing up. We're not, you know, I think there was

a moment when people kind of felt a little shocked and frozen. And I would say that is not

what I'm saying now. That's encouraging to hear. So why was your first big battle about encryption?

So important to the development of the entire internet as we know it today. Yeah. So, you know,

when the internet was before the World Wide Web. So this is the 1990s. The, the government,

the US government took the position that encryption, which is of course the science of secret codes.

It's the way that we can have security and privacy under digital networks. But it's a much older

science. It's a science of applied math. You know, Caesar had a cipher. The founding fathers of

the United States wrote to each other in code. Remember Jefferson was in Paris and Adams was in

London and the rest of the founding fathers weren't Philadelphia or wherever they were. They wrote

in code to each other so that the crown couldn't tell what they were saying as they were

fomenting a revolution. So encryption is very old and it's really important tool. But as the

internet was being developed, it wasn't being deployed. And the part, the huge part of the reason

that it wasn't being deployed was because the US government had treated software with the

capability of maintaining secrecy as a weapon. It was on the list of things that you cannot

export from the United States without a license. And the next to surface stare missiles and tanks

is software with the capability of maintaining secrecy. So the founders of EFF and some of these

early internet hacker types who I met really realized that if we were going to have any security

and privacy in the digital world at all, we had to get rid of these encryption regulations.

And they asked me, somewhat new lawyer, to take the case. And we did. And it was a very fun story.

We were lucky. We got a very good judge in Northern District of California,

named Marilyn Hall Patel, who listened to us even though we were basically a bunch of nobody's

going up against the NSA. And then the Ninth Circuit Court of Appeals listened to us as well.

And as a result of that fight and a lot of other work in Congress and in the public opinion and

even in Silicon Valley, the government eventually gave up and deregulated encryption. And that's why

we haven't in all the things that we have it in today. And circling back to that conversation about

banking, you know, without encryption, you couldn't trust that your bank was actually your bank.

That's right. You could be giving some other random person money. And that's why that

recent AI thing where they only let certain people see it because it found vulnerabilities in all

these places that could be exploited. So that's a whole different topic.

No, but it's really important. And it's, you know, this is, you know, we don't have enough security

online. We still don't know how to build software that is, you know, completely secure or private.

But we would be in so much more shape if we did not have the tool of encryption. We are,

we are, you know, kind of much better than we would have been and we still have far to go

in terms of securing the internet. And AI is definitely supercharging the worries.

You write a lot about the moment after 9-11 when it appeared that they already had this stuff.

They just had sitting in a file to surveil us, but they're just waiting for the right moment to

roll it out. So your second big case that you write about a lot is this surveillance through

the telephone companies. People's telephone calls and their metadata, which you said is not

just about the outside of an envelope. It's about understanding everything inside the envelope

from the outside, which maybe you could probably characterize better than I just did. But it really

brought home to me what the fight was about. It was about our privacy of our very private calls

and conversations of who, not only who we talked to, but how often they could figure out all this

stuff about us without even needing to go inside the phone call and listen to it. Can you explain

what you were objecting to in that lawsuit? And I'm amazed at how long it took and what a big,

huge fight the government put up to be able to keep surveilling us kind of made me mad.

Yeah. Good. If it made you mad, I'm winning. I was right. So I remember that whole thing

because I was around. Yeah. Yeah. I mean, this is a very long battle and it featured two whistle

blowers, one of which you probably have heard of named Ed Snowden and another one of which you

probably have not named Mark Klein. And a bunch of other whistle blowers as well, but they're the kind

of two predominant ones who were willing to tell the public what the government was doing in secret.

And you're right that one of the fights in the middle of all of this was the government saying,

well, don't worry, we're not listening to your phone calls when they got caught. And

well, first of all, that wasn't quite true, but at least with regards to the content of your

internet messages. But the other thing that is is it's kind of irrelevant. So, you know, there's

a very famous, pretty famous quote that I talk about there from the guy on the NSA guy named Michael

Hayden and another former general counsels of the NSA who say, basically, you know, we kill

people with metadata, right? That they are able to target people, figure out who they are,

who their networks are, who they talk to, who they love, who they spend their days with

and their nights with simply by the metadata. And even think about that, you know,

you carry around a phone that has your location data in it. That's metadata. That's not content.

But if I get enough of that information, I know an awful lot about you and indeed probably

don't need to know the content of your communications in order to know everything I need to know,

to target you, undermine you, and basically take away your power and your privacy.

So, one of the fights that we had to take on and the midst of this was, you know, this government

argument that, you know, we're not listening into your phone calls really doesn't mean what they're

wanting us to think it means. It doesn't mean that we actually have privacy.

You talk about the case of Kinsera, we wo, and also the protesters were on a oil rig.

And we're basically tracked down and shot by the militia of that country based on metadata.

So, that's a pretty big red flag about how serious them having this information can be.

Yeah, I have to add to correct you just slightly. I don't think that the Sarah Weowa case was based

on metadata. They just arrested Ken, but I'm and killed him. So, and the protesters as well.

They knew exactly where they were. They didn't need metadata for that in Nigeria.

But there have been plenty of other situations. And, you know, one of the kind of more famous one was,

this was a little dated now, but the, you know, the president of

oh my gosh, we might need to edit this out because I'm just blanking on it.

Let's just say that there are plenty of other incidents where metadata has been used for targeting

for killings. Well, and certainly in the case of ICE and Alex Prety, they think that he was

first tracked, you know, and then retract down. And he wasn't an accident where they found him

the second time. So, it's being used currently. Oh, yeah. And, you know, there's testimony in a case

in Oregon involving some ICE raid, some big ICE sweeps where an ICE agent says we have this

tool. It's called Elite. It comes from Palantir. And it gives us a Google maps like representation of

where the immigrant population is. And we use that so that we target our sweeps where there's a

lot of them. So, where does that data come from? Well, we don't quite know for sure,

but it seems likely that they are either buying or acquiring data from the data brokers that

track all the work, you know, track us over our phones and using that to fill out their Google

maps like targeting tool. Your organization, the Electronic Frontier Foundation developed an app

that helps you browse free of tracking. I know that's not quite the same thing that you're talking

about here, but can you talk about what it does and how people can download it if they so desire?

Yeah, absolutely. It's called Privacy Badger. It is a plugin for Google Chrome or Firefox or

any of the Chrome-based browsers. You can plug it in and it will block third-party cookies for you,

which is one of the many ways that the websites that you're visiting or that you log into

still may be able to track you, but there's all these other trackers that we know about

and that follow us around in our web surfing. Privacy Badger will help block those things for you.

It's a really easy tool to use. It's got a nice little slider if you can turn it off if something's

out working for you. Turn it back on again. It's really, you know, EFF does some very sophisticated

stuff to support encryption. That's kind of under the hood of the internet called SERP Bot.

This is something that everybody can use. Consumers can use. It's really easy and that, you know,

many, many people say, you know, that's the one thing that I made sure I installed on my mom's

computer or my, you know, or my mom's installed on mine. I'm not, no, no ages in here. There's

plenty of technical people who are grandmas as well, but it's something that you can provide to

the non-technical people in your life to help make them just a little safer.

Well, speaking of the age gap I teach, you know, 18 and 19 year olds at the university

here in Santa Cruz, and quite often they just give up like they think, well, they're surveilling

me so much anyway. Why should I bother to try to protect my privacy? I know I should, but I don't

really know how and I feel like it's hopeless anyway. What would you say to my students

who say that? And my guest is Cindy Cohen. She's the author of Privacy's Defender, my 30-year fight

against digital surveillance by MIT Press. She'll be visiting UC Santa Cruz on May 19th, so you might

get asked some of these questions. Yeah, no, and I think it's a really important thing, and I understand

deeply that feeling like you should just give up. There's nothing you can do. It feels like an

endless battle to try to protect your privacy. So I have a lot of sympathy for that position. I will

say a couple of things. One is, you know, in the aftermath of the Dobs decision in Roe versus Wade

overturned, I think it came as a big shock to a lot of people that you could go to jail for helping

somebody get an abortion or for getting one yourself. And, you know, we had a mom and her

daughter in Nebraska where they were talking over Facebook Messenger about the daughters need

for an abortion, and the mother went to jail for two years. So if you thought that this could never

happen to you, that nothing, I think that was a big wake-up call for a lot of people. We're also

seeing it with the ICE agents who are now, you know, there's a case in, in addition to the one I

talked about in Oregon, there's a case in Maine where the ICE agents, you know, were, somebody was

exercising their first amendment right to follow them, and the ICE agents drove to their house

and pointed to it in order to intimidate them because they have information about where the

protesters live. So I think if you think there's nothing you can do and that you just have to give up,

that's a bit of a place of privilege, right? Because if they, if you knew that doing nothing meant

that they were going to pick up your neighbors, I think you'd actually think that you might need to

do anything. It's a bit of a privileged position to say, oh, I have the luxury just to give up,

because what you're saying is, I don't think anything really bad will ever happen to me as a result.

And I just think that that might have been something you were sure about at one point in time,

but as we're living through times where the aperture of who could be targeted is, is getting,

is moving really fast. And even if you think you're safe today, you may not be feel so comfortable

tomorrow. And you know, there's a lot of students on campus who've been engaging in activism around

Palestine, activism around ice. And I think that it, the idea that that that's going to never

result in something happening to you is really not very consistent with the reality of the times

that we're living in. So you can give up if you want to, but it may put you in risk and actually,

honestly, privacy is a team sport. It's not just about you. There's all these people in your

context database. You know, there's all these people who you live near, who you love, who are in

your life. And even if you might not be at risk, you know, especially in California with the mix

of people who we have or a college campus, you probably know somebody else who can. We know that

they're trolling through social media right now, looking for people with green cards to say

things critical of the government to try to, you know, to revoke their green cards. So,

you know, I would venture that there's almost nobody on the campus of UC Santa Cruz who doesn't

have somebody in their contacts who's at risk. And so it's, it's important to not kind of step

you, think that you can step out of this. The other thing we're seeing increasingly

is on the commercial side. Like I, people don't, the, the, the profiles that are being built by

people by about people are being used to decide what jobs they get offered, how much salary they

get offered, how much they pay for things. Yeah, that's called price discrimination. So, I think

that it's increasingly clear that that's kind of a privileged and divorced from reality position

to take. Now, what does that mean? It doesn't mean it's your fault. If you can't take steps, many

people can't take all the steps that a super technical person might be able to take. It's not your

fault if you don't. You need, but it does mean that you should think hard about what steps you

might be able to take. And then, of course, this is my big pitch, join in the effort because we have

to change the law, we have to change policy, we have to change cultural norms, and we have to change

our tech to make it easier for people to be protected. It shouldn't be something you have to take massive

extra steps to do. But we've set up our world that way, and we need to fix it. Certainly, you

take on Facebook who promised to protect your privacy and then ended up being one of the worst

actors breaking it. And then we have Doge. So, you write both the US tax code and the privacy act,

protect information we reveal to the government for one purpose for being used for another. Doge

pretty much broke that law. Are they being held to account? Is there a class action lawsuit on

behalf of all of us taxpayers who have been so abused by this? I don't know. There's, I don't know

of a national class action, but there's litigation. So in the IRS case, there's a couple of these cases,

and it's people who are in immigration, who's in immigration, immigration groups are doing this

because that's what ICE was looking for. Was people who were targeted in some of the other Doge

cases. There are, as I mentioned, the labor unions are doing a bunch of this work. EFF has a

case against the Office of Personnel Management, the government's HR database for the Doge's access

to that. We just filed for a summary judgment, which is the kind of winning on the papers this week

to try to kick the Doge's out and find out what happened, and we are representing a bunch of unions

through that one. So there's lots of litigation. I don't know about a national taxpayer litigation,

but hopefully we don't, we don't need, those are kind of hard to do for a number of reasons,

but there's definitely a, you know, a failing sub litigation. I've lost track of how many lawsuits

there are against the Trump administration for what they do, for what they're up to, and they are not

always winning. You know, the lower, there's a lot of very brave lower courts. I think we may start

to see some things out in the Supreme Court. We'll see, but we have to keep trying because we have

to protect people. So you've been with this organization for 26 years doing this brave work,

going up against the big boys, you know, both corporate big boys and government big boys,

and I will use that pretty without caution because most of them are men, if you look at who was

sitting behind the president at the inauguration, it was all mostly guys. So after all this time,

are you going to miss fighting these fights? Are you going to continue in a different guys?

I'm going to continue in a different guys. So I am, I am stepping down from EFF. I think it's

healthy for an organization to let new people come and pass the torch. And I'm very excited that

my good friend Nicole Oager has been named the new executive director of EFF. Nicole started the

Northern District of California ACLU's first division on technology and people's rights,

which was the very first ACLU one in the country. And now they're all over the place. And Nicole

was really the brains behind all getting the ACLU involved in digital rights. And she's been very

successful there. She's been running a clinic at UC San Francisco law school, which used to be

called Hastings. And, and she's going to come and take the reins over at EFF. And that's going to

be great. I'm really excited for this. As for me, yeah, I kind of want to get back in the fight.

As you can tell from the stories, I really like being a fighter. And, you know, you find when

you're the executive director of an organization of 120 people, you really, you just don't,

you can't be in the fight at the level that you want to be. So I'm very proud of what we did at EFF.

I spend a decade doing it. But now I don't want to get back to some of the roles that I have in

the book where I'm much more the frontline advocate. And that's, that's not something you can do

as the executive director. So I'm going to say in the fight, as I told the EFFers, there's a t-shirt

that I actually gave John Stewart when I was on the daily show. And then I wore that says,

you know, let's sue the government. It's an EFF t-shirt. And as I told the staff when I announced

that I was leaving, you know, I don't, I don't actually think I'm done sue in the government yet.

Right. And in your book, you know, I guess at one point Edward Snowden has a big sticker from EFF on

his computer. And he does. And I guess the government lawyer said that means, you know, you must have

endorsed him or something. It was just a sticker. But you guys get around. And I've been at the

forefront of some really amazing challenges to our current state of surveillance capitalism.

Yeah. So a lot of what you went up against were governments or

and then you went up against some corporations. I wonder if these powerful people who have been

giving money to the Trump administration, like the bezos of the world and the mosques,

whether there's any check on them because they seem to be the ones driving this with their massive

infusions of cash. Without them with the tech bros, you know, leading this, we might not be

quite as far down the road. And are there plans to challenge some of these giant corporations that

seem to have their hands in our pockets as well as in our bedrooms? I mean, sure. EFF does a lot of

work to try to create, you know, accountability for companies. We have long supported a comprehensive

privacy law. Honestly, I'd like to cut their business model off at the knees and make surveillance,

the surveillance business model illegal that data collected from us for one purpose cannot be used

for another purpose without a very, very high standard that is not a clickbox. I mean, that is the

engine of, you know, most of the tech giants right now. That's what they're doing. They're surveilling

everybody for profit. So EFF has long taken the position that that that that we need a comprehensive

privacy law. It needs to be very strong. My personal belief is thinking about this as secondary

uses and cutting those off is a really fruitful way to think about it. There are other ways to think

about it. Like that we're not short of ways to solve the problem or short the political will

to do it. And that's what we need to do. California has a decent privacy law. I'd like to see

it strengthened. So I think that I think that, you know, all of the surveillance that I talk about

in the book, you know, they didn't come to us and ask us for telephone records. They came to AT&T

in Verizon or the tech companies to do that. So that's not, so yes, there's a lot to be done to

try to reign in the tech companies. The particular piece you identify, like how do we get money out

of politics and money out of this is not actually my expertise. There are plenty of people doing

that work and God bless them. EFF is kind of more on the kind of technology itself rather than

technology billionaires giving too much money. There's a lot of people working on systems united

and some of the other ways that we might want to reform the election. And I'm all for it. But

that's kind of not our piece of the story. Well, you have a big piece of the story and we're

enjoying a lot of privacy that wouldn't be there otherwise. So thank you for your hard work over

these years. I wonder if in closing because this is our big pledge drive for our little community

radio station in Santa Cruz, which has got a big footprint. If you have any thoughts on, you know,

broad testing and especially the small grassroots community stations in the big picture of

communications and spreading the word about the kind of work you do. Oh, I just think it's so

important. I mean, community radio and community conversations is where really real change happens.

The corporate media is never, you know, they're increasingly all buying each other, owning each other,

swapping each other. You know, now the tech moguls are buying some of our big media. It's not good.

And I think that to the extent there's hope it lies in community radio. It lies in

you know, community, even, you know, community websites that track what's going on in the

community that are not beholden to the big money. And so it's the only way we get that is if

people support it. It's if we support it, then it's ours. If you if some big rich guy comes in

and support it, it's theirs. And then we only get the news that they want us to have. And if

there are good guys, we get good news. If there's bad guys, they get bad news. And my my view is

always that the answer to a dictatorship is not to try to make the dictator better. It's to get rid

of the dictators. And the way we do that is develop and support and honor the alternative ways

that we can get information. Well, Cindy Cohn, it's been such a pleasure to talk to you,

author of Privacy's Defender, my 30 year fight against digital surveillance, coming to UC

Santa Cruz, Tuesday, May 19th. Thank you so much for being here on Talk of the Bay. It's been

a great pleasure. Oh, thank you so much. And I hope to see you when I come down. Yes, looking

forward to it.