[00:00.000 --> 00:07.820]  Our last talk for today will be You Are Not a Digital Native and That's Okay by Cory Doctorow.
[00:10.690 --> 00:15.290]  Thank you very much. Hi, I'm Cory Doctorow. I write science fiction novels for young people
[00:15.290 --> 00:20.250]  and I work for the Electronic Frontier Foundation. It's a pleasure to be back here at DEF CON Kids
[00:20.250 --> 00:25.730]  at Roots. And the talk today is called You Are Not a Digital Native. So you may have heard people
[00:25.730 --> 00:30.010]  come up to you and say like, hey, you're young, that makes you a digital native. Something about
[00:30.010 --> 00:36.190]  being born after the millennium or born after 1995 or whatever, that makes you sort of mystically
[00:36.190 --> 00:41.630]  tuned in to what the internet is for. And anything that you do on the internet must be what the
[00:41.630 --> 00:46.770]  internet is actually for. And I'm here to tell you that you're not a digital native, that you're just
[00:46.770 --> 00:52.110]  someone who uses computers and you're no better and no worse than the rest of us at using computers.
[00:52.110 --> 00:56.230]  You make some good decisions and you make some bad decisions. But there's one respect in which
[00:56.230 --> 01:01.110]  your use of computers is different from everyone else's. And it's that you are going to have to
[01:01.110 --> 01:05.210]  put up with the consequences of those use of computers for a lot longer than the rest of us
[01:05.210 --> 01:11.310]  because we'll all be dead. So there's an amazing researcher named Dana Boyd. She studies how young
[01:11.310 --> 01:16.190]  people use the internet and computer networks. She's been doing it for about 20 years. She was
[01:16.190 --> 01:21.650]  the first anthropologist to work with a big tech company. She worked at Intel, at Google,
[01:21.650 --> 01:26.810]  at a company called Friendster that's no longer extant. She worked at Facebook. She worked at
[01:26.810 --> 01:31.990]  Twitter. And one of the things that she sees over and over again is that young people care a whole
[01:31.990 --> 01:37.210]  lot about their privacy. They just don't know who they should be private from. They spend a lot of
[01:37.210 --> 01:42.570]  time worried about being private from other kids they go to school with, from their teachers,
[01:42.570 --> 01:46.610]  from their principals. But they don't spend a lot of time wondering about how private they need to
[01:46.610 --> 01:51.330]  be from the government in 20 years looking backwards to figure out who their friends are
[01:51.330 --> 01:54.510]  and what they were doing when they were in school and whether or not they're the wrong kind of
[01:54.510 --> 01:58.430]  person. They don't spend a lot of time worrying about what a future employer might find out about
[01:58.430 --> 02:01.950]  them. But they spend a lot of time worrying about what other people might find out about them. And
[02:01.950 --> 02:07.210]  they go to enormous lengths to protect their privacy. So Dana, she documents kids who are
[02:07.210 --> 02:12.210]  hardcore Facebook users. And what they do is every time they get up from Facebook, every time they
[02:12.210 --> 02:17.970]  leave their computer, they resign from Facebook. And Facebook lets you resign and then keeps your
[02:17.970 --> 02:23.310]  account open in the background for up to six weeks in case you change your mind. And if you come back
[02:23.310 --> 02:27.130]  and you reactivate your account, you get all your friends back, you get all your posts back,
[02:27.130 --> 02:31.070]  and everyone can see you again. But while you're resigned, no one can see you on Facebook,
[02:31.070 --> 02:34.930]  no one can comment on you, and no one can read your stuff. So this is a way of them
[02:35.370 --> 02:39.630]  controlling their data. And that's what privacy is. Privacy isn't about no one ever knowing your
[02:39.630 --> 02:44.950]  business. Privacy is about you deciding who gets to know your business. And so young people really
[02:44.950 --> 02:51.730]  do care about their privacy, but sometimes they make bad choices. Now that matters because privacy
[02:51.730 --> 02:57.130]  is a really big part of how we progress as a society. You know, there are people alive today
[02:57.130 --> 03:02.430]  who can remember when things that today are considered very good and important were at one
[03:02.430 --> 03:06.430]  point considered illegal and even something you could go to jail for, right? So one of the great
[03:06.430 --> 03:10.930]  heroes of computer science, a guy named Alan Turing, the guy who invented modern cryptography
[03:10.930 --> 03:17.050]  and helped invent the modern computer, he went to jail and then was given a kind of bioweapon,
[03:17.050 --> 03:21.410]  hormone injections, until he killed himself because he was gay, right? So that was in
[03:21.410 --> 03:25.390]  living memory. There are people alive today who remember when that happened to Alan Turing.
[03:25.490 --> 03:29.250]  Today, if you're gay, you can be in the armed forces, you can get married, you can run for
[03:29.250 --> 03:34.310]  office, you can serve all over the world. The way that we got from it was illegal to be gay,
[03:34.310 --> 03:38.070]  and even if you were a war hero, they would hound you to death if you were gay,
[03:38.070 --> 03:43.630]  it's totally cool to be gay and you can marry the people you love, is by people having privacy.
[03:43.850 --> 03:48.190]  And that privacy allowed them to choose the time and manner in which they talked to the people
[03:48.190 --> 03:53.130]  around them about being gay. They could say, you know, I think that you and I are ready to
[03:53.130 --> 03:57.570]  have this conversation. And when they had that conversation, they could enlist people to their
[03:57.570 --> 04:03.250]  side. And one conversation at a time, they made this progress that allowed our society to come
[04:03.250 --> 04:09.330]  forward. So unless you think that like now in 2017, we've solved all of our social problems,
[04:09.330 --> 04:15.090]  and we're not going to have to make any changes after this, then you have to think that like,
[04:15.090 --> 04:21.010]  at some point in your life, people that you love are going to come forward and say to you,
[04:21.010 --> 04:24.730]  there's a secret that I've kept from you, something really important to me.
[04:24.730 --> 04:29.470]  And I want you to help me make that not a secret anymore. I want you to help me change the world
[04:29.470 --> 04:35.130]  so that I can be my true self. And without a private realm in which that conversation can
[04:35.130 --> 04:41.790]  take place, those people will never be able to see the progress that they need. And that means
[04:41.790 --> 04:45.830]  that people that you love, people that are important to you, those people will go to their
[04:45.830 --> 04:50.470]  graves with a secret in their heart that caused them great sorrow because they could never talk
[04:50.470 --> 04:56.490]  to you about it. So we talk about whether or not kids are capable of making good decisions
[04:56.490 --> 05:01.910]  or bad decisions, whether effectively kids are dumb or smart. And I think the right way to think
[05:01.910 --> 05:07.030]  about this is not whether kids are dumb or smart, but what kids know and what they don't know.
[05:07.030 --> 05:12.510]  Because kids can be super duper smart. Kids can be amazing reasoners, but kids don't have a lot
[05:12.510 --> 05:17.350]  of context. They haven't been around long enough to learn a bunch of the stuff that goes on in the
[05:17.350 --> 05:22.850]  world and use that as fuel for their reasoning. That's why you hear about children who are
[05:22.850 --> 05:27.950]  amazing chess players or physicists or mathematicians, because the rules that you
[05:27.950 --> 05:32.710]  need to know to be an amazing chess player, you can absorb in an hour. And then if you have a
[05:32.710 --> 05:37.810]  first-rate intellect, you can take those rules and turn them into amazing accomplishments.
[05:37.810 --> 05:44.110]  But you've never heard of a kid who is a prodigy at history or law, because it just takes years
[05:44.110 --> 05:50.090]  and years to read the books you need to know to become that kind of amazing historian or legal
[05:50.090 --> 05:56.210]  scholar. And so when kids make choices about privacy, it's not that they don't value their
[05:56.210 --> 06:01.930]  privacy. It's that they lack the context to make the right choices about privacy sometime.
[06:01.950 --> 06:07.130]  And over time, they get that context and they apply their reasoning, and then they become better
[06:07.130 --> 06:12.590]  and better at privacy. But there's something that works against that privacy, against our ability
[06:12.590 --> 06:18.970]  to learn the context of privacy. The first is that our private decisions are separated by a lot of
[06:18.970 --> 06:24.830]  time and space from their consequences. So imagine trying to get better at kicking a football or
[06:24.830 --> 06:30.070]  hitting a baseball, and every time someone throws the ball, you swing the bat. But before you see
[06:30.070 --> 06:34.770]  where the ball goes, you close your eyes and you go home. And a year later, someone tells you whether
[06:34.770 --> 06:39.530]  or not the ball connected with the bat and where it went. You would never become a better batter,
[06:39.530 --> 06:45.410]  because the feedback loop is broken. Well, when you make a privacy disclosure, it might be months
[06:45.410 --> 06:51.130]  or years or decades before that privacy disclosure comes back to bite you in the butt.
[06:51.130 --> 06:56.110]  And by that time, it's too late to learn lessons from it. And if that wasn't bad enough, there are
[06:56.190 --> 07:00.710]  a whole lot of people who wish that you wouldn't have privacy intuition, who hope that you won't
[07:00.710 --> 07:05.570]  be good at making good privacy choices. And those people often are the ones who are talking about
[07:05.570 --> 07:10.690]  digital natives, who want you to believe that whatever dumb privacy choice you made last week,
[07:10.690 --> 07:14.350]  you made because you have the mystical knowledge of how the internet should be used,
[07:14.350 --> 07:19.490]  and not because you made a dumb mistake. And those people, they tend to say things like,
[07:19.490 --> 07:24.110]  privacy is not a norm in the 21st century. If you look around, you'll see that young people
[07:24.110 --> 07:29.030]  don't really care about their privacy. What they actually mean is, I would be a lot richer
[07:29.030 --> 07:34.270]  if you didn't care about your privacy. My surveillance platform would be a lot more
[07:34.270 --> 07:40.930]  effective if you didn't take any countermeasures to protect your data. So it's really hard to get
[07:40.930 --> 07:46.190]  good at privacy, partly because it's intrinsically hard, and partly because we have a lot of people
[07:46.190 --> 07:52.990]  who use self-serving BS to try and confuse you about whether or not privacy is good or bad.
[07:53.250 --> 07:59.890]  Ultimately, privacy is a team sport. Even if you take on board lots of good privacy choices,
[07:59.890 --> 08:06.390]  even if you use private messengers, even if you use private email tools like GPG and PGP,
[08:06.390 --> 08:10.650]  even if you use full-disk encryption, the people that you communicate with,
[08:10.650 --> 08:16.530]  unless they're also using good privacy tools, all of the data that you share with them,
[08:16.530 --> 08:20.090]  it's just hanging around out there with no encryption and no protection.
[08:20.210 --> 08:24.290]  And so you have to bring those people on board. And that's where the fact that young people do
[08:24.290 --> 08:28.710]  care about privacy, even if they don't know exactly who they need to be private from,
[08:28.710 --> 08:35.730]  that's where this comes in. Because young people's natural desire to have a space in which they can
[08:35.730 --> 08:40.750]  conduct their round without their parents, without their teachers, without fellow kids
[08:40.750 --> 08:46.030]  looking in on them, that's an opportunity for you to enlist them into being more private,
[08:46.030 --> 08:50.290]  into having better control over who can see their data. So I'm going to leave you with
[08:50.430 --> 08:55.290]  a recommendation for where to look for those tools. Electronic Frontier Foundation, for whom
[08:55.290 --> 09:03.130]  I work, we have a thing called the Surveillance Self-Defense Kit, ssd.eff.org. And it's broken up
[09:03.130 --> 09:08.330]  into playlists, depending on what you're worried about. Say you're a journalist in a war zone,
[09:08.330 --> 09:13.210]  or maybe you're a kid in a high school, we've got different versions of the Self-Defense Kit for you.
[09:13.210 --> 09:17.270]  It's in 11 languages, so you can get your friends. If you come from another country,
[09:17.270 --> 09:20.810]  you can get friends in other countries to come along with you. And that way,
[09:20.810 --> 09:27.830]  you can all play the privacy team sport, and you can use your youthful curiosity to become
[09:27.830 --> 09:32.390]  better consumers of privacy and better practitioners of privacy. And then the
[09:32.390 --> 09:36.690]  internet that you inherit, that will be long dead and you'll still be living with,
[09:36.690 --> 09:40.810]  that internet will be a better internet for you. Thank you very much.
[09:52.260 --> 09:57.560]  Oh hey, so I just found out we've got free t-shirts from the Electronic Frontier Foundation.
[09:57.560 --> 10:01.860]  They're these awesome designs, they have all the best things from the internet. There's a cat,
[10:01.860 --> 10:07.660]  there's books, and there's CCTV cameras, which are all the things the internet has. If anyone
[10:07.660 --> 10:12.760]  has a question, the thing I will redeem the question for in addition to an answer is a t-shirt.
[10:12.780 --> 10:19.260]  So anyone got a question? Yes, go. Oh, they're smalls, but you may have a friend who could
[10:19.260 --> 10:35.660]  wear it. Or you could wear it as a hat. Go. Oh, how legal is it to decrypt Bluetooth packets?
[10:35.720 --> 10:40.280]  Well, you know, Roots has this amazing code of ethics that you can see over here that's about
[10:40.280 --> 10:45.280]  what you should and shouldn't do. And one of those things is you should be messing with your own data,
[10:45.280 --> 10:50.740]  but not other people's data. If you're messing with your own data, if you're looking at a tool
[10:50.740 --> 10:55.280]  that you own, like a Bluetooth card that you own and analyzing it, then in general, it's pretty
[10:55.280 --> 10:59.560]  legal. But let me tell you, there are a couple of ways in which this can get you into trouble.
[10:59.700 --> 11:03.660]  And the reason I'm mentioning is not to scare you, but to let you know that EFF has your back.
[11:03.660 --> 11:10.840]  So there's a law called the Computer Fraud and Abuse Act, the CFAA of 1986. And under CFAA,
[11:11.360 --> 11:15.000]  let me tell you the story of how CFAA came to exist. Do you ever see a movie called War
[11:15.000 --> 11:19.400]  Games with Matthew Broderick? So after War Games came out, people went like,
[11:19.400 --> 11:24.040]  my God, teenagers are going to start World War III. Congress has to do something. So Congress
[11:24.040 --> 11:28.560]  passed this unbelievably stupid law called the Computer Fraud and Abuse Act in 1986.
[11:28.660 --> 11:33.580]  And what they said is, if you use a computer in a way that you don't have authorization for,
[11:33.580 --> 11:39.000]  it's a felony and we can put you in jail. And so that has now been interpreted to say,
[11:39.000 --> 11:45.680]  if you violate terms of service, which is the authorization you have to use some website,
[11:45.680 --> 11:50.120]  you are exceeding your authorization. Well, like every one of us violates terms
[11:50.120 --> 11:53.740]  of service all day long. If you've ever read terms of service, what they say is,
[11:53.740 --> 11:59.020]  by being dumb enough to be my customer, you agree that I'm allowed to come over to your house and
[11:59.020 --> 12:02.420]  punch your grandmother, wear your underwear, make long distance calls and eat all the food
[12:02.420 --> 12:09.060]  in your fridge. And every one of us violates those rules all day long. And when prosecutors
[12:09.060 --> 12:14.280]  decide they don't like you, they can invoke the Computer Fraud and Abuse Act. Now we have defended
[12:14.280 --> 12:18.640]  many clients who've been prosecuted under the Computer Fraud and Abuse Act, and we will continue
[12:18.640 --> 12:24.360]  to do so. We're agitating for a law called Aaron's Law. It's named after a kid named Aaron Swartz,
[12:24.360 --> 12:30.640]  who was a good friend of ours. He was one of the founders of Reddit. He's an amazing kid.
[12:30.840 --> 12:38.040]  Helped invent RSS when he was 12 years old. And in 2013, after being charged with 13 felonies
[12:38.040 --> 12:43.000]  and facing a 35-year prison sentence for violating the terms of service on MIT's network
[12:43.000 --> 12:48.480]  and downloading academic articles, he killed himself. And so we've been fighting in his name
[12:48.480 --> 12:53.520]  to try and reform this law ever since. We're also involved in fighting to reform a law called the
[12:53.520 --> 12:59.980]  Digital Millennium Copyright Act, or DMCA. And the DMCA has this section called Section 1201,
[12:59.980 --> 13:05.200]  and it says that if there's a system that protects a copyrighted work, that tampering with that
[13:05.200 --> 13:11.100]  system is also a felony that can put you in jail for five years and see you with a $500,000 fine
[13:11.100 --> 13:16.260]  for first offense. And one year and two weeks ago, we filed a lawsuit against the US government
[13:16.260 --> 13:21.480]  to get rid of that law too, because it's being used to stop people from repairing their own cars,
[13:21.480 --> 13:26.160]  figuring out how their computers work, jailbreaking their phones, doing all kinds of normal things
[13:26.160 --> 13:31.200]  that you would expect to be able to do with your property. Now, in general, what you do with your
[13:31.200 --> 13:35.540]  Bluetooth device, that's your own business. But laws like the Computer Fraud and Abuse Act and
[13:35.540 --> 13:39.400]  the Digital Millennium Copyright Act, they get in the way of that. And that's one of the reasons
[13:39.400 --> 13:45.220]  EFF is so involved in trying to kill them. Thanks for your question. Here, take some textiles.
[13:45.720 --> 13:48.900]  Yeah, go ahead. And here, I'm going to come down so I can hear you.
[13:56.500 --> 14:03.740]  So the question was, what's my favorite science fiction question to write about? And so I'm one
[14:03.740 --> 14:08.240]  of a small but growing number of science fiction writers who write what I call techno-realism.
[14:08.240 --> 14:13.700]  So usually in science fiction for like 50 years, maybe even longer, whenever a science fiction
[14:13.700 --> 14:17.920]  writer wanted to do something in the plot, they'd just stick a computer in and say,
[14:17.920 --> 14:22.300]  oh, computers are able to do this thing or computers aren't able to do this thing to
[14:22.300 --> 14:26.760]  make the plot go forward without any actual reference to what computers could do.
[14:27.120 --> 14:31.460]  And, you know, I think that like 60 years ago when computers were the size of buildings
[14:31.460 --> 14:39.300]  and like 11 people in the world had ever used one, that was like an easier kind of magic trick
[14:39.300 --> 14:44.140]  to play without anyone figuring out where you hid the card. But today, I think a lot of people
[14:44.140 --> 14:50.440]  know how computers work. And so I like to write stories in which the actual capabilities and
[14:50.440 --> 14:56.320]  constraints of computers are the things that the computers turn on. And so, you know, we've got,
[14:56.320 --> 15:01.920]  like, I've got books like Little Brother that are 10 years old that people still read as
[15:01.920 --> 15:07.800]  contemporary futuristic science fiction, even though I wrote it 12 years ago, right? And that's
[15:07.800 --> 15:13.200]  because the things that computers can and can't do, theoretically, those aren't going to change.
[15:13.200 --> 15:18.400]  Maybe like how we use them will change, but the underlying computer science theory is pretty sound.
[15:18.440 --> 15:27.270]  And so that's how I like to work in my science fiction. All right, one over here. Yes.
[15:35.810 --> 15:40.730]  So the question was, how do you know when it's safe to share your information, when it's a good
[15:40.730 --> 15:45.910]  idea? Well, you know, that's really hard. Like, I make bad decisions about that all the time.
[15:45.910 --> 15:51.890]  Like, many times I've gone and made a choice to, like, give some data to a website or whatever,
[15:51.890 --> 15:56.850]  and then I find out that, like, that website, like Yahoo, right? Yahoo was compromised for
[15:56.850 --> 16:03.770]  five years before they told anyone that they leaked everyone's data, right? And so it's really
[16:03.770 --> 16:11.990]  hard to know for sure when to do that. I think that, like, some of it is just trying to remember
[16:11.990 --> 16:18.130]  what you thought might happen when you made a disclosure, and then comparing it to what
[16:18.130 --> 16:25.650]  happened. And some of it, I think, though, is that we need companies to be more careful with
[16:25.650 --> 16:31.010]  our data. And one of the ways to do that is to hold them to account when they make bad choices.
[16:31.010 --> 16:38.010]  So right now, like, a company that breaches all your data, generally they don't owe you any money.
[16:38.010 --> 16:43.390]  Home Depot breached 80 million customers' credit card records, and they had to give each of them
[16:43.390 --> 16:49.170]  about 33 cents and a six-month gift certificate for credit monitoring services. So, like,
[16:49.170 --> 16:54.450]  if those companies actually had to pay what it would cost their customers over that breach,
[16:54.450 --> 16:58.290]  then I think those companies would be a lot more careful with their data.
[16:58.290 --> 17:02.770]  So some of it is us getting better at making the choice, but some of it is the companies
[17:02.770 --> 17:09.550]  having to pay the cost for being part of that stupid choice, right? Thank you for your
[17:09.550 --> 17:14.630]  excellent question. All right. We've got two more t-shirts. Yeah.
[17:26.740 --> 17:33.180]  So the question was, how can other people get involved in fighting all these fights? So if
[17:33.180 --> 17:39.480]  you're on a university campus, Electronic Frontier Foundation has this network of campus organizations.
[17:39.480 --> 17:44.220]  If you email info at EFF.org and say that you'd like to get your campus involved,
[17:44.220 --> 17:49.860]  that's a thing you can do. Joining EFF's mailing list is really useful. We will send you
[17:50.540 --> 17:55.720]  targeted notices when, like, your lawmaker needs a phone call from their voters saying,
[17:55.720 --> 18:01.120]  get out there and make a good vote. Obviously, like, you know, writing EFF a check is a nice
[18:01.120 --> 18:05.080]  thing to do. You know, we're a member-supported nonprofit. We get our money mostly from small
[18:05.080 --> 18:11.220]  money donors like you. Making good privacy choices yourself and then helping other people
[18:11.220 --> 18:16.120]  around you make those choices. Having this conversation, you know, like, people say,
[18:16.120 --> 18:21.120]  like, oh, my mom will never figure out how to use this stuff. And, you know, like, first of all,
[18:21.120 --> 18:27.360]  it gives moms a super bad rap because, like, people design technology for the convenience
[18:27.360 --> 18:32.980]  of, like, bosses. Like, if a technology can't be used easily by, like, someone's boss,
[18:32.980 --> 18:38.080]  that person gets in trouble. If a technology can't be used easily by someone's mom, they're like,
[18:38.080 --> 18:43.680]  oh, my mom's dumb, right? And so, like, moms have to work, like, 100 times harder than bosses.
[18:43.840 --> 18:49.940]  And so, they're like ninjas compared to bosses. So, like, bosses suck at using technology,
[18:49.940 --> 18:55.300]  not moms. But there are people in your life, the kind of people who might come to DEF CON,
[18:55.300 --> 18:59.780]  who haven't really thought this stuff through, if you had this conversation with two people
[18:59.780 --> 19:05.260]  in the next month, you would triple the number of people in your circle who care about this stuff.
[19:05.360 --> 19:13.020]  Right? Thank you. Have a t-shirt. All right. Who's got the last question? It has to be really
[19:13.020 --> 19:28.840]  good, but no pressure. Yeah, hang on. So, the question was, he just got here,
[19:28.840 --> 19:34.440]  can I repeat the entire speech all over again? I can, but it's just the hash of the speech.
[19:34.440 --> 19:44.160]  So, it's really short. It's like 0-E-X-1-1-7-9-7-3-7-9-8-7-7-7. So, you can just compare
[19:44.160 --> 19:55.560]  that to the recording, make sure that hasn't been tampered with. All right. So, the question was,
[19:55.560 --> 19:59.980]  are any of my stories going to be made into movies? I've had a ton of stuff optioned. I've
[19:59.980 --> 20:04.020]  got a thing under option at Paramount right now, Little Brother. There's a Bollywood studio that
[20:04.020 --> 20:08.160]  has an option on my book, For the Win. But most stuff that gets optioned doesn't get made. It's
[20:08.160 --> 20:13.640]  that's like a pull process, not a push process. The author doesn't get to show up and say,
[20:13.640 --> 20:16.700]  now you make my movie. It's more like someone comes along and says,
[20:16.700 --> 20:19.840]  maybe we'll make your movie. And you're like, okay, give me some money. And then you wait.
[20:19.960 --> 20:26.900]  So, I'm just waiting. Thank you. All right. Thank you all very much. Have a great Roots.