Welcome to the Politics of Privacy and Technology Fighting an Uphill Battle.
It's going to be an exciting time, we've got a lot to talk about, and I'm going to kick it off
with a little bit of introductions, then we're going to talk about what we're going to do.
So, I'm going to hand it over to Dan.
Alright, my name is Daniel Zolnikov. I'm a representative out of the state of Montana,
so I serve in the state of Montana in Helena. I do not...
I'm a politician, so I don't really expect that yet until you figure out what we're trying to do.
So, we'll see. Let's see, really quick, just the basics of why I ran for office.
I ran because I don't like what's happening in politics.
Everybody runs for that until they realize how the game works.
Well, I didn't like how the game works as well, so you'll see how I stood up to some of those interests
and what we tried to do on behalf of people, not special interests.
One little nice side note is that I still have a BlackBerry,
so hopefully it's the one thing that won't be hacked during this entire conference.
You can follow me on Twitter at Daniel Zolnikov.
Last little quick note is I'm originally from a town called Roundup, Montana.
2,000 people in like a 30-mile radius.
This is probably about the whole size of my town in this room right now.
And about myself, I am not a politician, but I hang out with them.
Thank you. I'm done.
I'm a hacker. I break things, just like you guys.
I run a security company.
I run a security consulting firm in Bozeman, Montana.
I know you guys are thinking, what do you hack out there?
I get on the plane a lot, and it's the Internet.
I can do it from my pajamas.
So we have a lot of fun.
It's great being able to ski and adventure and hang out
and then go home and, you know, hack hospitals and stuff.
So it's a good time.
I adventure a lot.
I tweet under Subsector Corp.
I get to do a little bit of public policy, as was this speech,
working with Dan, helping people out, doing a little bit of training.
And a little bit of speaking.
So we're going to kind of just jump right into this.
What do we want to talk about?
So, we did a lot.
Dan and I are here to talk to you about a little bit about information and politics in Montana.
And for all of you, you might be going,
ah, Montana, just another state.
But Montana is good in that it models and represents what a lot of other state legislators do.
Maybe on a little bit of a smaller scale.
But everything that we talk about today is just as applicable for the states that you live in.
Maybe not for all of you.
Maybe not for all of you that live overseas, hopefully you live in democratic nations.
But in America, you know, it's broken down into the state system.
And Montana is very representative of all the other states.
So everything we do here can be replicated.
We're going to talk about privacy legislation, what we did, what we got to be passed.
We did, Daniel here was able to get some privacy legislation passed to make sure your cell phones are safe.
Yeah!
But we tried so, so much more.
And that did not pass.
But we realized what we need to do to get privacy legislation passed in Montana.
So we're going to talk about that and our future goals.
Okay, so really quick, I'm going to talk about Montana and Montana's legislature.
Kind of like what Eric spoke about prior.
If we get something passed in Montana, we're not talking about just what we get in Montana for Montanans.
It then is shown to the rest of the states and you get passed in other states on behalf of you.
I mean, I don't really rely on the feds for making good policies anymore.
So I think states' rights are a big one.
We can do it in Montana.
We can do it anywhere.
The size of Montana is comparable to the size of Germany in an area.
The population, though, is about a million people.
So we have a lot more cows than people.
Legislature serves 90 days every two years.
So if you want to talk about limited government, four months every two years.
That is not too much.
And we also have term limits.
I can serve four terms in the House and four terms in the Senate and then be termed out.
That is very limited.
There's not a lot of new, there's always new politicians in there.
And the majority of the House and the Senate is Republican.
The governor is Democrat.
This is extremely important to know.
I really don't care anybody's political affiliations right now.
It's the fact that you have to work through both sides to get legislation passed.
And that's what we're going to discuss as well.
Really quick, let's see if that shows up.
This is a quick little screen shot of where Montana is.
For those of you who don't know, the border above is, hey, hey, Las Vegas is in the bottom left hand corner.
A fun little side note is that we drove from Montana to Las Vegas in 15 hours, so this is our other accomplishment.
So we're going to preface kind of about what we wanted to do and give you a back story for the whole situation.
So right now, how many people know about PRISM, NSA, rampant violation of your rights?
Everybody, right?
It's bad, okay?
And so everything, thank you, everything that we did was before that.
So think of yourself six months ago and go, did I care too much about privacy?
For some of you, maybe, this is DEF CON, right?
We're the more heightened and more aware of privacy issues.
But six months ago, a lot of people were just like, I trust my government.
And so it was a whole different mindset before that until now with the recent revelations where they go, maybe I shouldn't.
Daniel was his first term as a legislator.
He was a freshman, which is a feat in and of itself for getting the bill passed because there's so many things that you can do.
There's so much that these guys have to learn, figure out, and basically navigate the jungle of politics in addition to everything else.
So it was his first time doing that.
He hadn't built the connections, hadn't figured out the process.
Next time is going to be way spectacular.
Not that we didn't accomplish a lot.
And then myself, I worked with Dan doing a little bit of research, working with him, bringing the privacy idea kind of to life.
So that's where we're coming from.
So what we want to talk about, why is there a need for privacy laws?
Like I said earlier,
six months ago, a lot of people didn't necessarily know why we needed these privacy laws.
We wanted to create legislation to enforce Montana's constitutional right to privacy.
And that's important.
Not every state has a constitutional right to privacy.
So we're lucky that we have kind of something that we can base all of our laws off of that's enumerated in the Constitution so we can say,
look, we're just doing what the Constitution says.
And I'm going to read it out because it's very important.
Article 10 of the Montana Constitution states the right of privacy, the right of individual
privacy is essential to the well-being of a free society and shall not be infringed without the showing of a compelling state interest.
Awesome, right?
This was written by a bunch of guys who didn't even have, you know, technology.
And they were thinking about privacy when our Constitution was implemented.
It's important, it's essential.
And our rights and liberties don't necessarily have a meaning if we don't have clear laws that protect them.
We have a constitutional right to privacy.
But if we don't have that enumerated in individual laws, then we don't have, citizens don't have the tools necessary to enforce that.
All right.
So HB 603 is the privacy bill that actually got passed.
Our speech, though, is not about saying good job to ourselves, we got a bill passed.
It's about the one that failed.
Still, I'm going to touch on this first.
This is cell phone privacy requiring law enforcement to obtain a search warrant before being able to collect location information from electronic devices.
This was not considered a big deal at the time because the NSA event had not occurred yet.
This was a very short and simple bill.
It was one page long.
It had emergency opt-outs, like in case you need to respond to a 911 call or a life threatening situation.
So it was a pretty balanced bill that I had, I worked with both sides.
I listened to both sides.
I'm talking about Republicans, Democrats, to get it passed.
And it was considered a common sense bill.
A lot of people I spoke to afterwards was like,
wasn't that already in law?
No, no, there's no policy on privacy, really.
Especially with cell phones, things like that.
This has passed and has since been considered model legislation.
And we originally got the idea from another state that failed to pass it.
We got it passed, first one in the country.
Now other states are passing it.
And that actually makes you feel pretty good.
And Montana, who meets once every two years, is in the lead on some of this stuff.
Thank you, thank you.
So here's just a few headlines covering that bill across the United States.
And it's amazing how much press this has received.
And I'm really happy for it.
Montana leads the way in new age privacy rights.
Montana anti-spying law, good, more needed.
Montana, with Montana's lead, states may demand warrants for cell phone data.
If you don't want the government to spy on you, move to Montana.
All right, that one, they just went with it.
I had no say in that.
One of my favorite things to all these headlines, if you guys
check Reddit, I think some of these articles were submitted.
And one of my favorite comments was, I don't even know where Montana is.
How are they first, or like, where is Montana?
And we're still first.
It's excellent.
OK, so cell phone privacy was not the goal.
The real story starts with the bill that I will refer to as HP 400, which
was the Montana Data Privacy Act.
The goal is to use different legislation across the world
to create a balanced act to protect data.
There's a lot of good ideas.
Why not put them in together?
And form something that will protect the average citizen,
constituent?
The real battle over HP 400 is what gives us the insights into
what everybody has to face across the states with the
privacy policy challenge.
So I'm going to talk about a little bit of the policy
frameworks of HP 400.
Because we knew we were embarking on a large journey.
And I'm sure, you know, we figured, you know, six, 12
months ago, however long it was, that we probably weren't the
first ones to go.
Hmm, privacy is important.
So we looked at a lot of other different frameworks that we
wanted to talk about.
And there's a lot of really excellent model laws, if they
were passed or not, on individual states and foreign
countries that are excellent fodder for basing it off of.
So first, we looked at California's civil code.
And in it, we got a really excellent idea.
And it reads, each agency shall maintain in its records only
personal information which is relevant and necessary to
accomplish a purpose of the agency.
And this is important, because it's basically arguing that
agencies are only allowed to collect information that's
pertinent to them.
And so we like that idea.
It's the idea that, you know, all these different companies
and agencies shouldn't just have these huge dragnets collecting
all of this information that they don't need.
It's the idea that, okay, business has to get done, but
you don't need to go much further than that.
Next, we went on to Massachusetts laws.
Massachusetts has some excellent privacy legislation.
Part of their, part of their, part of their, part of their
part of it says, section two, regulations to safeguard personal
information of commonwealth residents.
This is important because we got the idea that if you collect
information, you should probably be careful with it.
You know, a great example is South Carolina.
How many of you guys heard of that breach?
Yeah.
South Carolina got owned hard.
They lost millions of their residents' and citizens'
information, names, social security.
I think the whole nine yards.
If you have that information, you should probably, I don't know,
secure it if you need it.
And so this is the argument that for businesses and government,
that if they do have this information, they shouldn't
just leave it on a Windows XP box or something.
Some of the hackers in the crowd, right?
It's like trivial to steal at that point.
You have to actually care enough to make sure it's secure.
Next, we got the duty to report known security breach or
unauthorized use.
This basically gives us the idea that, okay, so now we have
companies, hopefully, collecting only the information they need
and actually protecting that information.
And if they're protecting that information, they should know
when they're breached, which means that citizens should be
alerted to that.
If your information is stolen and you don't know it, you can't
react to that.
Businesses shouldn't just try and cover it up and go, oh, that
never happened, because it did.
And it impacts people and is necessary for them to let them
know that.
Next, we went on Germany privacy laws.
So a little side note about me is all my grandparents are
immigrants.
Half of my grandparents from my mom's side are from Italy.
From my dad's side, his parents are from Russia.
And they had to move away from Russia when communism basically
took over and took out the czars, all that good stuff.
So I always had a skepticism about, you know, let's look at
other historical past issues that have happened.
What do you think?
What's happened in other countries?
Why is it bad?
How can we learn from it?
I think it's really good, especially if I'm studying
policy, to be able to have a little insight into history to
make sure we do not repeat our mistakes or other countries'
mistakes.
Well, Germany's data privacy laws, basically, they have a
few things that we looked and liked.
And I think most of the reason why these were created was
because the Stasi, when the Cold War era was, the secret police
were watching over East Germans.
It was collecting all this information about them.
It was the secret police.
So from what I understand, these laws are put in place to protect
the German citizens.
And that includes preventing organizations from collecting
any personally identifiable information without obtaining
permission from an individual.
And that includes name, birthdate, phone number, IP
address, personal address, things like that.
Then there needs to be permission for the collection of
data, which must be specific, including how, where, how long,
and for what purposes the data will be used.
And then individuals may revoke permissions at any time, and
policies, procedures, controls must be put in place to ensure
that all the organization's data is being collected.
This is a major point.
This is the consent to have information collected.
We'll hit that over and over.
It's one of the most important points of our entire piece of
legislation.
Okay.
So the creation process.
You go on, research.
Oh, yeah.
I'll talk about research.
Thanks, Comrade Zolnikov.
I'm just kidding.
So a lot of research went into this.
A lot.
But that's a good thing because we were able to say, hey, we took a
look at what everyone else is doing, how it impacted those other
countries, and we could use them as a use case and go, hey, look,
Germany can do it.
Why can't we?
Because throughout the whole process, lobbyists, business
people, everyone just kept going, that's impossible.
That's never going to happen.
And it's nice when you can have a clear case that goes, yes, it's
already been done.
And so we did research into what everyone else was doing and into
what we wanted to do.
And we're going to talk a little bit more about that when we go in
depth on HP400.
But basically what we did, we researched the bills, we drafted
this lengthy human readable document, something that you and I could
understand, and then I kind of tossed it over the fence to Dan to
let him handle it.
And the best thing about a state with a very low population is I
went to college with Eric.
That's how I originally know him.
He gives me a call.
He's like, hey, let's look at this type of policy.
We're trying to do this.
Well, all of a sudden I'm the representative and I call
legislative services with the draft that he wrote and he put
together and I send it to them who then put it into a bills
form.
That is your true form of representative government in my
opinion.
So we did, that's exactly what happened.
And the legislative services is a group that works for
legislators to, like I say, put it in form that can actually
become law and goes from our notes sketched out to a base
basic form of language.
It's the foreign language called legalese.
Exactly.
As far as I'm concerned.
So then they send it back.
We read it.
We say, no, that's not exactly what we meant.
We send it back.
They do it.
And then we send it back until we both think it's pretty good.
And then?
And then it all came together into, dun dun, HB 400.
This is the big bill.
This is the meat and potatoes of our presentation.
This is our basic lining out of what we want to see privacy in not
only Montana, but the United States.
So we're going to talk about the main points of the bill and then
some of the issues that we had getting it passed.
I mean, call me naive, I kind of thought, oh, I'll put all these
great ideas together and then they'll get passed by government.
Turns out it's a little bit more involved than that.
So we're going to talk about that, some of the issues, and go
from there.
So to talk about the main points.
A lot of these, you know, it's going to feel like you've
already heard them before because I talked about other
types of legislation that we had pulled from.
So point one of HB 400 was that data sets are going to be
collected and the data subjects must be given notice when their
personal information is being collected.
Pretty easy, right?
It's something that would be fairly easy to implement and
fairly easy to do.
It's saying that if you are giving your information up and a
company is going to be using it, they have to tell you.
It's building awareness because a lot of people don't realize
that when they get that information or when they go to
Safeway and use their Safeway card, which gives them a five
cent discount, they don't realize that there's a secret
little transaction going on where the company is basically
getting all of their purchase history and then selling it.
They need to realize that.
They need to be told this is happening.
Next is personal information may be used only for the purpose
stated and not for any other purpose.
And this kind of ties in with the California law, which is
saying that they should only have the information necessary
to do their job.
So, you know, there's no reason for your bank to be selling
information or using it in a healthcare manner.
It's basically keeping these things separate and distinct.
Next is personal information.
Personal information may not be collected or disclosed without
the data subject's consent.
As it stands currently, your information is being rampantly
bought and sold without even you knowing, without your consent.
And that is a problem.
You need to have ownership of your data.
You need to know where it's going, who has it, why it's
being sold.
Then we get on to points four through seven.
Personal information that is collected must be kept secure
from any potential abuses.
Already kind of talked about this.
If you're going to have data, you should protect it.
Next, data subjects must be informed as to who is collecting
the personal information.
You've got to understand who is collecting your information so
that if they do have it, you can reach out and say, hey, I would
like you to delete that.
Or, hey, I'd like you to update that.
Because that ties into data subjects must be allowed access
to their personal information to make corrections on any
inaccurate data.
Kind of one of the ones that we kind of slid in there at the end
because the idea being your information is being traded all
around and it is needed for legitimate business in certain
circumstances.
And so because it's your data, you should have the opportunity
to update it.
One of the great examples is credit reports.
Right now it's kind of a black box on where they get their
information from and who knows if it's accurate or not.
You should be able to review it and go, no, that's not me or
that's when someone stole my identity and have the opportunity
to fix it.
And then we jump into data subjects must have a method
available to them to hold data collectors accountable for
following the principles in this section.
And this is one of the most poignant clauses in the entirety
of this.
It's saying that people now have recourse for when their
privacy is taken.
They have recourse for when these companies rampantly
disregard for their privacy.
They now have legislated action that they can refer to in civil
suits if a company violates this.
We have it in our Constitution, but by having it in a law, it
allows them to do so much more.
So that was HP 400 in a box.
So now we're going to talk a bit about, you know, we had this
great idea.
We built this giant framework for privacy.
What are some issues we had?
One of the biggest ones was definitions.
And then we had opt-outs and extenuating circumstances and a
little bit of things with small business.
One of the biggest ones is definition issues.
When we wrote this, when you get into a project and you start
using the terminology, especially in technology, you
just kind of start to use the inside terms.
But to someone on the outside, it doesn't necessarily make the
same sense.
And so to counteract this, we tried to have all these
definitions, like agency, block agency.
And a lot of the legislators just kind of read it and glazed,
their eyes glazed over.
And it doesn't help with phrases like data subject being hard to
differentiate from customer and individual.
So we realized we really need to tone down the language of the
bill, for Montana at least, for it to be understandable by
representatives and citizens alike.
Okay.
So I'm going to go back to the politics side of it.
Please don't get political and too motivated on your side of
the aisle versus what I stand for.
I am a conservative Republican.
The Republicans had the House and the Senate.
This bill had to keep that in mind because Republican
conservatives are very, they listen a lot to make sure that
it's a business friendly environment so it can stay
competitive so they don't want to overregulate industries.
Well, there are a few overreaching clauses and this is
probably the biggest one that we had in that bill which was
probably a little bit too far, which I actually think is too
far myself now that I've really read it, focused on it.
And I'll read it as quick as I can.
A business may not refrain from conducting commerce with an
individual solely because the individual refuses to consent to
the business's collection, processing, or use to the
individual's personal information except when the
personal information is genuinely needed for the
business to provide the service or product requested to complete
a financial transaction or to comply with the law.
Basically this says if you want to get a cell phone plan with a
cell phone company and they say, hey, we are going to collect
your information, you say, no, you're not and you don't give
consent, well, this would say that the cell phone company
still has to give you a cell phone plan since their business
isn't focused on, since their business isn't focused on that
information that they're collecting.
And that's wrong because if you don't want to work with them,
if you don't want to consent, well, I don't believe that the
business still has to offer everything up.
You are now informed they're collecting your information.
You're going to go to the competitor who's saying, hey,
I'm not collecting your information.
You're going to start buying their services.
That's the way I think it should go.
So there are a few overreaching clauses like this.
Another one was the small business burden.
Can small businesses comply?
Say we have a local mom and pop shop that collects your
information, your address, your credit card information,
whatever, there's some things that they're collecting.
Well, do they have the ability to have it all secure?
Are they putting it in a secure location or are they keeping it
on their desktop which they also use with the business on an
Excel spreadsheet?
Which could easily be lost.
I don't have a, I'm not going to say, yeah, this is really
important, not important, that I stand for, that I'm too
concerned on either end of it.
Because this was really a philosophical conversation that
we were having in the house.
Does it hurt smaller business?
Well, the question is, should they be getting information and
collecting it if they cannot keep it secure?
One of the many issues and points that were brought up.
Okay.
So now we're going to talk about from the political side, the
people issues that I had to deal with.
This includes leadership issues, the extensive push back from
lobbyists, my favorite part, the fact that it was considered
too long at 26 pages and that the representatives didn't really
understand it or read it.
It's not all doom and gloom, though, because Daniel does have
a really nice slide I'm going to hit next for you just because I
like it so much.
Okay.
So this is the bill.
We have two days to get, or the first page of it anyway, we have
two days to get signatures put on it.
But I received 37 signatures from the House and the Senate.
Out of 150 individuals, the senators and representatives in Montana,
I got 37 signatures, about a fourth who were supportive of this.
This was on both sides of the aisle.
And I didn't get to talk to everybody.
I was trying to speak to members of the Appropriations Committee where
I was trying to get the bill put into so it could be heard in that
committee so it had a better chance of surviving.
I wasn't completely idealistic thinking everybody would like it.
I knew the committee would have to go to to get it passed beyond so it
could then get heard on the House floor and then sent to the Senate and
hopefully signed.
This was a really good achievement, believe it or not.
These co-sponsors, they may not support everything in the legislation,
but they support the idea of it.
And that's one thing that's great about Montana.
Both sides of the aisle, some of the people who would not be in the same
room together and thus are forced to have their names on this bill.
Okay.
Leadership issues.
Conservative leadership was in the House and the Senate.
I'm in the House.
I'm a House representative.
So I was begging that this bill of mine, this really important bill that no one
else really cared about at that point because they were worried about their
making Montana more job friendly or doing some of the taxes.
We had a $300-some million surplus that they were worried about how we were
going to spend it or we were going to get it back.
Their focus was on different issues.
Mine was about down here on the priority list of importance.
So they promised that my bill would end up in the House.
They promised that I would end up in the Judiciary Committee.
The Judiciary Committee is where we talk about gun bills, gay rights, abortion bills,
sex slavery, I mean all the hot items.
The press was always in there.
This is the committee where they battle it out.
And you can believe and you can bet that this committee is very stacked on the
Republican and Democrat side.
It's the people more worried about liberties and rights than they are about
lobbyists telling them what to do.
And since privacy I think is a big rights issue, this was the perfect bill or
committee for my bill.
It's also a committee that a lot of people don't want their bills to go into
because it's where their bills tend to die.
I was begging to have it in there.
Please put my bill in appropriations.
Well, in the end, leadership was not concerned about it and my bill was
starting to cause some issues because there's a lot of big business, special
interests that were pushing against it from the start.
And so the bill ended up being put in the Business and Labor Committee to be killed.
So we're going to talk about the lobbyist side of things.
I do not really like lobbyists or a lot of special interests.
They're hard people to love.
They're like the same class as meter light maids.
Well, I'll tell you one thing.
Exactly.
From a side note, politicians think they're really smart so they know if they appeal to
the special interests, they'll get help for campaigns, they can get reelected, and then
they can serve again and then they'll do what they need for the special interests to get
more money to then serve again.
And it's like why the hell are you in politics is my question if that's really what you're
standing for.
Well, I had some issues with them because some of the representatives in Business and
Labor Committee especially serve as easy votes to their sponsors, aka lobbyists.
They're like this isn't my issue.
I'm serving because of one big issue so I'm going to do what you want along the way.
I'm not going to be in the line for all these other ones.
They hear a bill is bad, they're like oh here's three bullet points, it's bad, it grows
government, all those things, I'm going to kill it.
Well, this was painted from a lot of the bigger lobby groups as more regulation and growing
government.
It was a bad bill and as a conservative Republican, they were just painting me as a rhino,
a sellout, a moderate, like oh, Daniel, this is just bad legislation and we need to get rid of
this.
this. And in reality they were concerned about losing the
ability to profit from consumer information. They make a lot of
money from it. There's really no standards. So they don't want
standards put on it yet. And this is the conversations that
some of us had behind the doors. The funny thing is we're trying
to put standards in place that will protect the business instead
of saying it's illegal to collect information like some
individuals want to do. We're just trying to have a balance to
make sure people have their rights involved. Well they
didn't want any of it because at this point in time, they can
have the pushback to kill some type of legislation. I obtained a
very quick reputation with my quick tolerance for lobbyists.
And I learned later on from a nicer older gentleman who's been
around the block that they called me the mad Russian. And I
guess they were kind of right in some regards. Okay. So also
the understandability problems. Partially a generation. So
problem. Politicians tend to be old. I'm 26. I'm serving in the House of Representatives.
So young Democrats and Republicans knew what we were talking about on this privacy issue.
They knew how far technology has gone in the last 10, 15 years. I mean, I am not a techie guy.
Ironic that I'm speaking at DEFCON. Eric is the guy I rely on for that. But even I understand
that this is a big issue that we need to work on and at least protect some rights if we can.
That's the way I'm looking at it. There were older representatives in there on the business
and labor committee who helped kill the bill in the end that barely knew how to use computers,
that didn't have a smart phone. I mean, some barely used their phones at all. It was very
interesting that they're the ones that we're trying to appeal to and they don't know what we
are talking about. Also there's a lack of awareness on the privacy issue. Not an important
issue. There are bigger issues. Like I said, we had 300 some million dollars to spend.
That's a lot more fun spending other people's money than trying to protect people's rights.
Here's a really quick story I'll have on the side. There was a bill that we call the Facebook bill.
It was more than just Facebook. It would prevent employers from collecting employees' login
information, passwords, things along those lines. The city of Bozeman was doing it for a while
until they got sued. There were other organizations saying, hey, you want to work for me? I need your
login information, your password so I can search through your e-mail account, search through your
Facebook. To me it's the same thing as, hey, you want to work for me? I got to search through your
house and your underwear drawer first. It's a little bit too much. So we're just trying to put
some guidelines in place. It passed the Senate 48 to 2. It got killed in the business and labor
committee. Let me go back. Passed the Senate 48 to 2. This was a very controversial Senate that
got some national headlines for how much they hit their heads. And they are the ones that are
going to get all voted besides two of them for this legislation. Business and labor committee, it
goes to there. The business lobby tells a lot of the business and labor guys this is bad
legislation. It needs to be killed. And I heard a story on how there was a guy, a representative in
his 70s, didn't even, from what I understand, barely knew what Facebook even is. Not much how to
hack it. And he barely knew what it was. He heard that he asked a younger guy, a younger
representative, hey, is this good legislation? Is this bad legislation? And the younger guy,
who appeals to lobbyists and basically plays the political game, the exact opposite of me,
plays it, he told him, oh, this is a really bad bill. This is really bad. It's really bad for
business. We need to kill this bill. And there's your policy setting right there. Older guy
doesn't know what he's doing. Younger guy says kill it because you know what, he's more worried
about getting a better voting record at the end. The bill sizing issue. The bill is 26 pages long.
And it's all new legislation. This is considered a big bill by Montana standards. Obama's
Affordable Care Act, I really don't care again what side you are on with that issue. But that bill
itself is 1,000 pages. That's a big bill in my opinion. This is 26 pages in Montana legal speak in
a sense that it's really easy to understand Montana code. You can read it not having any law
experience and just read it and understand exactly what the code is doing. Very simple. This
bill is considered 26 pages long and that was way too long. And it was complex since we would
have to have our own privacy standards for Montana than the rest of the country. Which is what we
wanted. So then, yeah, it's what we wanted because then we wanted other states to follow our
legislation. If we can do it, then you can do it. It also proposed a lot of new ideas in one
document. And if things you don't understand that are new can be kind of scary. So we ran into
those issues.
Now, let me go on the committee meeting. There were two proponents. I was the sponsor so I spoke
first. There were two proponents of this bill. One was Eric. So thanks for showing up to that
one. I figured I should probably wake up to that one. And the ACLU. I was so happy someone was
sitting next to me in that meeting. The irony is that as a conservative Republican, I'm usually
over here. The ACLU is over here. But now it's not only me, a few of us are trying to get a lot of
votes. We're trying to find more legislation like this because we agree on privacy legislation to
work on. So I'm very thankful they're supportive and that now they're willing to work on other
legislation. The cell phone privacy bill, they're also big supporters of. So I'm very happy about
that. There's some reaching across the aisle for you. The line of opponents were supposed to be
the guys in my group camp usually in politics. And that included the Montana Retail Association,
the Montana Telecommunications Association, there are multiple insurance companies, Montana Auto
Dealers Association, the Montana Bankers Association, multiple hospitals, the Chamber of
Commerce, Montana Collectors Association, and the Montana Data Association. I mean, if that room
would have all of a sudden exploded, there would have been no more lobbyists for the business
front in Helena. It was so absurd that they literally queued to say the same thing. It was like
they were lining up between each other and like raising their hand. It was more than said on why
they didn't like it, which was just basically, you know, it's not fair. It's not fair. It's not
their business. Yeah, well, and as a new representative, I think they really wanted to prove a
point to me as well that, hey, if you're not going to be doing what we need you to be doing, then
this is what's going to happen. I am a very slow learner. So I guess next time we'll see what
happens. Also, the committee meeting, let me just touch on one other thing on politics. Say you are
all about privacy legislation. You're with me. You know all about it. Well, as representatives, we
deal with legislation across all these different areas. And I think it's really important for us to
know what that legislation is. So how much do you know about farming? Okay. There's a farming
bill. How much do you care about it? I'm from Roundup, Montana, and I still wouldn't trust my
views on farming to know what this legislation is going to get passed. So I have to depend on
someone else. It's not really my issue. This sounds good. It's a short bill. It's three main
points for it, three main points against it. I'm hitting 10, 20 bills a day. I'm trying to read,
understand, pass. So this was basically their farming bill in that sense. They were not concerned
about privacy rights. They were concerned about privacy rights. So they were concerned about the
rights. It's not an issue. It's a non-issue issue. So on the doors, I knocked on a lot of doors
for my campaign. No one really was talking about privacy rights. They were talking about money.
They were talking about taxes. They were talking about jobs. Not this issue. So the committee
members were pretty much unengaged. So in a roundabout way, thank you, President, for
bringing awareness to the issue. Yeah. Got to look at the silver lining just a little bit.
Okay. So the end result was that it was tabled in committee. Duh, duh, duh, duh, duh, duh.
Like I said, it was in the wrong committee in the first place, and nearly all the lobbyists that got
along with the Republican side were not supportive of any type of privacy legislation. They're
like, well, you know, we want to work with you to get it. When they talked with me before the bill
was presented, they wanted to be exempt from it. They don't want it to apply to them. And that's not
really what we're trying to do. We're trying to make sure that personal information belongs to the
individual. That's what they want. So I think it's important to think about that. I think it's important to
Uh, the bill was too large and most legislators didn't understand the premise of why we need
this legislation. Like I said before, it was a non-issue issue. And then again, it was also
HP 400 was called, was considered growing government and creating unnecessary laws.
I was considered all of a sudden a big government, uh, conservative and I was, I just,
whatever that they can call it, they could label it however they want. Uh, that was fine.
I prefer the nickname Mad Russian for you. Yeah, me too. Nice. So, the end result was,
sadly, the demise and death of HP 400. But like a phoenix from its ashes, we will rise again
with more policy and more effort. Um, what we did and what we realized is we tried way too much.
Uh, 26 pages for Montana is about 25 pages longer than most other bills.
So, we're going to try to make it as long as possible.
So, let's try and break it down. Uh, we realized that at that time, privacy didn't affect people
directly. It wasn't something that they could tangibly see and touch and be afraid of or happy
about. Uh, and so we were two or three months ahead of our time. Uh, and then we didn't really
compromise it. And Dan, you know, more so is, is, I want to thank him for being solid and not
compromising on privacy, kinda. He was there the whole way to make sure that we had the full
privacy. But what we also realized is at a certain point, you know, businesses still have to
operate. And we can't just put on a lot of legislation to, you know, to, to make privacy
better on the, the citizen right side, but make it so burdensome that a small business can
actually operate. So, we realized, you know, we still need to work with these people. Uh, and
then some additional thoughts. We were new to the process. 26 years old, first time
serving. There's still a lot to learn. Yeah, yeah. Room ahead to grow. Uh, there's a lot of
informal, informal opportunities that we didn't quite realize had to be done. Uh, we didn't fund-raise.
Apparently you need money to push ideas. Uh, I know. However, we're working on it. Uh, and we
didn't have a motivating story. We didn't have a story that basically, you know, people could
latch on to. We didn't have a story that people could look at and go, oh my gosh, this is why I
need privacy. And to a limited extent, we now kind of have that story with Prism. So, there were
some funny, unexpected results that came out of it. Okay, so this is an award that I received
from a, another fellow representative. This is the first time that I've ever received an award
from a representative. The Order of the Black Helicopter for Representative Daniel Zolnikov for
the Outstanding Conspiracy Theory Creation from the Man in the Yellow Hat. And he gave me a
black helicopter as well. I set it right here on my desk for the rest of the session. Which is
funny, because have you talked to him since he did that? Yeah, actually, yeah. I spoke to him
and he has, he has said he's sorry and that he definitely supports my legislation now. So.
. .
You need to buy him a yellow submarine. So, another thing was that lobbyists took me a
little less serious. Or some took me more serious. If they went against anything I was doing, they
spoke to me because they knew I could care less on their stances and that I was not okay with the
whole special interest thing, not keeping other people in mind. So, I get taken a little bit less
serious by some who just don't really speak to me at all. So, I'm going to take a little bit more
serious. Those are the ones I probably respect a little bit less anyway. And then there's some that I
talk with and they make sure where I'm at and they see where I'm at. It's a good thing. They have,
there's a lot better communications and it's served a lot better. Also, a lot of groups and
representatives especially know my views on special interests. I am not serving for that of
special interests. I'm serving for what I think is best for people. That's what I thought
government was supposedly for. And you know what? My reelection will be a little tougher, but that is
why I'm there. And now I'm getting a lot of support. So, it's fine.
So, like I said, we're revising the strategy. We're going to break it up. We had seven points.
We're going to break it down into seven individual topics so that each one can have a compelling
story, so we can build support, so we can work with people. We're going to create clear cases for
each new bill. We're going to work with businesses to ensure that they understand our goals and
that we understand their hardships, ellipses, to a certain extent. And we're going to work with
them to a point, right? Because at a certain point, businesses would rather just not worry about
it. I've got their information. I'm not going to worry about securing it. And so it's about
building a balance. So, we have a goal. I'm going to let Dan talk a little bit about it.
Okay. Consent. It's only two pages about. It's just the first part of the bill. Consent is the
most important part because it says that this information being collected is actually your
information, not the people or the organizations or departments that are going to be involved in the
bill that collect it. It's not their information. It's still yours. So, consent implies just that.
If you give consent, most people will give their consent anyway. But we need it to say that this
actually does belong to me. It's the first step on the ladder to privacy. And if there's time,
we've got some more laws on the books that Dan has thought about. Really quick, there's the
protecting sources of the press. I think this is one of the most important ones. We're playing
around with this one still. Thank you. First amendment. Like I said, we need to start
legislating our rights. It's a sad time that we have to deal with this. We need to start
doing that. But since we've realized that, we need to start today. And that includes protecting
the press and then there's also allowing citizens to disable black boxes from their cars,
something along those lines. You driving around, you should not be collecting evidence against
yourself for possible future cases. Last one is banning automated license plate scanning and
collection for the state of Montana. Yeah! Montana has it. Red light cameras are
currently already banned in Montana. So we are just continuing that, yeah, we're continuing that.
We're working on it. We're in our final minutes, so we're speeding up. It all leads to model
privacy legislation. Montana is now a test bed for privacy. It's a test bed for this legislation.
So other states can go with their lobbyists, tell them this is never going to happen. You can go,
Montana did it. States' rights, setting a legal precedent for privacy and working with citizens
and not lobbyists. That's what we're working for. So, thank you. It's hard to get
angry this early in the morning, but we're almost done. We're almost done. And I'm going to read
you something from Wired Magazine that gets me a little annoyed, a little angered, if you will.
And so I think you will, too, when you hear it. The Obama administration for the first time
responded to the Spygate lawsuit telling a federal judge the wholesale vacuuming up of phone
call metadata in the United States is in the public interest does not breach the constitutional
rights of Americans.
And cannot be challenged in a court of law. I put emphasis on the very last bit of that.
The executive branch is telling the judicial branch that they cannot challenge that. And I submit
that when the people can no longer challenge the government, that government cannot necessarily be
called a democracy.
Thank you. And at the end of the day, all of us are responsible for the policies that we live
under. So there's still power in the hands of the government. But at the end of the day, all of us are
in the states, and we need to pay attention,
but do more than pay attention.
Do more than voting. You hear people say, if you don't like
politics, go vote. I submit, take it
one step further. Become a legislator.
Get involved in policy, because
you can make an impact. We already have laws
based on two people that have full-time jobs
and felt like making a difference.
So, with that, if you feel like
donating to him... Exactly.
When you stand up...
And might I mention, he's inspired
me to run for the next session as well.
Yeah, so Eric and I will both be running this
next time in Montana. The whole
thing is, if you stand up to special interests, sometimes
you lose their support, but Montana
has really low contribution limits of
$160 a person, so the whole
thing is, when it's that low, I
can say goodbye to those guys and hello
to people across the United States who support
this type of legislation, want to see
it be done somewhere, and actually see it
put through. And so
we've also included our friend Bryce Bennett.
He's actually a Democrat, so if you're very...
I won't donate to a Republican. We care about
privacy. That's what we
care about. So if you want to make an effort, and you
want to do something with dollars, right here.
Or if you want to contact us and work with us
on legislation, we'd love that too.
So guys, thank you.
Thank you.
Thank you.