WEBVTT 00:00.000 --> 00:07.820 Our last talk for today will be You Are Not a Digital Native and That's Okay by Cory Doctorow. 00:10.690 --> 00:11.950 Thank you very much. 00:11.950 --> 00:13.270 Hi, I'm Cory Doctorow. 00:13.270 --> 00:17.770 I write science fiction novels for young people and I work for the Electronic Frontier Foundation. 00:17.970 --> 00:21.250 It's a pleasure to be back here at DEF CON Kids at Roots. 00:21.330 --> 00:24.390 And the talk today is called You Are Not a Digital Native. 00:24.450 --> 00:29.470 So you may have heard people come up to you and say like, hey, you're young, that makes you a digital native. 00:29.470 --> 00:38.650 Something about being born after the millennium or born after 1995 or whatever, that makes you sort of mystically tuned in to what the internet is for. 00:38.650 --> 00:43.290 And anything that you do on the internet must be what the internet is actually for. 00:43.290 --> 00:52.110 And I'm here to tell you that you're not a digital native, that you're just someone who uses computers and you're no better and no worse than the rest of us at using computers. 00:52.110 --> 00:54.770 You make some good decisions and you make some bad decisions. 00:54.770 --> 00:59.290 But there's one respect in which your use of computers is different from everyone else's. 00:59.390 --> 01:06.950 And it's that you are going to have to put up with the consequences of those use of computers for a lot longer than the rest of us because we'll all be dead. 01:07.450 --> 01:10.430 So there's an amazing researcher named Dana Boyd. 01:10.430 --> 01:14.370 She studies how young people use the internet and computer networks. 01:14.370 --> 01:16.030 She's been doing it for about 20 years. 01:16.030 --> 01:20.030 She was the first anthropologist to work with a big tech company. 01:20.030 --> 01:25.030 She worked at Intel, at Google, at a company called Friendster that's no longer extant. 01:25.070 --> 01:26.390 She worked at Facebook. 01:26.390 --> 01:27.490 She worked at Twitter. 01:27.570 --> 01:33.550 And one of the things that she sees over and over again is that young people care a whole lot about their privacy. 01:33.650 --> 01:36.410 They just don't know who they should be private from. 01:36.450 --> 01:43.810 They spend a lot of time worried about being private from other kids they go to school with, from their teachers, from their principals. 01:43.890 --> 01:55.210 But they don't spend a lot of time wondering about how private they need to be from the government in 20 years looking backwards to figure out who their friends are and what they were doing when they were in school and whether or not they're the wrong kind of person. 01:55.210 --> 01:58.870 They don't spend a lot of time worrying about what a future employer might find out about them. 01:58.870 --> 02:01.870 But they spend a lot of time worrying about what other people might find out about them. 02:01.870 --> 02:05.170 And they go to enormous lengths to protect their privacy. 02:05.410 --> 02:08.950 So Dana, she documents kids who are hardcore Facebook users. 02:09.070 --> 02:15.390 And what they do is every time they get up from Facebook, every time they leave their computer, they resign from Facebook. 02:15.390 --> 02:22.490 And Facebook lets you resign and then keeps your account open in the background for up to six weeks in case you change your mind. 02:22.490 --> 02:28.590 And if you come back and you reactivate your account, you get all your friends back, you get all your posts back, and everyone can see you again. 02:28.590 --> 02:33.890 But while you're resigned, no one can see you on Facebook, no one can comment on you, and no one can read your stuff. 02:33.890 --> 02:36.550 So this is a way of them controlling their data. 02:36.550 --> 02:37.670 And that's what privacy is. 02:37.670 --> 02:40.470 Privacy isn't about no one ever knowing your business. 02:40.670 --> 02:43.770 Privacy is about you deciding who gets to know your business. 02:43.850 --> 02:50.070 And so young people really do care about their privacy, but sometimes they make bad choices. 02:50.110 --> 02:55.530 Now that matters because privacy is a really big part of how we progress as a society. 02:55.690 --> 03:05.810 You know, there are people alive today who can remember when things that today are considered very good and important were at one point considered illegal and even something you could go to jail for, right? 03:05.810 --> 03:20.570 So one of the great heroes of computer science, a guy named Alan Turing, the guy who invented modern cryptography and helped invent the modern computer, he went to jail and then was given a kind of bioweapon, hormone injections, until he killed himself because he was gay, 03:20.570 --> 03:20.870 right? 03:20.870 --> 03:22.050 So that was in living memory. 03:22.050 --> 03:25.390 There are people alive today who remember when that happened to Alan Turing. 03:25.490 --> 03:31.530 Today, if you're gay, you can be in the armed forces, you can get married, you can run for office, you can serve all over the world. 03:31.530 --> 03:43.630 The way that we got from it was illegal to be gay, and even if you were a war hero, they would hound you to death if you were gay, it's totally cool to be gay and you can marry the people you love, is by people having privacy. 03:43.850 --> 03:49.930 And that privacy allowed them to choose the time and manner in which they talked to the people around them about being gay. 03:49.930 --> 03:54.350 They could say, you know, I think that you and I are ready to have this conversation. 03:54.350 --> 03:58.350 And when they had that conversation, they could enlist people to their side. 03:58.350 --> 04:04.110 And one conversation at a time, they made this progress that allowed our society to come forward. 04:04.110 --> 04:21.010 So unless you think that like now in 2017, we've solved all of our social problems, and we're not going to have to make any changes after this, then you have to think that like, at some point in your life, people that you love are going to come forward and say to you, 04:21.010 --> 04:24.730 there's a secret that I've kept from you, something really important to me. 04:24.730 --> 04:27.770 And I want you to help me make that not a secret anymore. 04:27.770 --> 04:31.810 I want you to help me change the world so that I can be my true self. 04:32.030 --> 04:41.250 And without a private realm in which that conversation can take place, those people will never be able to see the progress that they need. 04:41.250 --> 04:51.790 And that means that people that you love, people that are important to you, those people will go to their graves with a secret in their heart that caused them great sorrow because they could never talk to you about it. 04:52.270 --> 05:00.650 So we talk about whether or not kids are capable of making good decisions or bad decisions, whether effectively kids are dumb or smart. 05:00.750 --> 05:07.030 And I think the right way to think about this is not whether kids are dumb or smart, but what kids know and what they don't know. 05:07.030 --> 05:09.410 Because kids can be super duper smart. 05:09.410 --> 05:13.230 Kids can be amazing reasoners, but kids don't have a lot of context. 05:13.230 --> 05:20.770 They haven't been around long enough to learn a bunch of the stuff that goes on in the world and use that as fuel for their reasoning. 05:20.770 --> 05:31.810 That's why you hear about children who are amazing chess players or physicists or mathematicians, because the rules that you need to know to be an amazing chess player, you can absorb in an hour. 05:31.810 --> 05:37.270 And then if you have a first -rate intellect, you can take those rules and turn them into amazing accomplishments. 05:37.590 --> 05:50.990 But you've never heard of a kid who is a prodigy at history or law, because it just takes years and years to read the books you need to know to become that kind of amazing historian or legal scholar. 05:51.130 --> 05:57.150 And so when kids make choices about privacy, it's not that they don't value their privacy. 05:57.150 --> 06:01.930 It's that they lack the context to make the right choices about privacy sometime. 06:01.950 --> 06:09.030 And over time, they get that context and they apply their reasoning, and then they become better and better at privacy. 06:09.170 --> 06:14.910 But there's something that works against that privacy, against our ability to learn the context of privacy. 06:14.950 --> 06:21.290 The first is that our private decisions are separated by a lot of time and space from their consequences. 06:21.570 --> 06:28.910 So imagine trying to get better at kicking a football or hitting a baseball, and every time someone throws the ball, you swing the bat. 06:28.910 --> 06:32.890 But before you see where the ball goes, you close your eyes and you go home. 06:32.950 --> 06:37.470 And a year later, someone tells you whether or not the ball connected with the bat and where it went. 06:37.530 --> 06:41.970 You would never become a better batter, because the feedback loop is broken. 06:42.090 --> 06:51.130 Well, when you make a privacy disclosure, it might be months or years or decades before that privacy disclosure comes back to bite you in the butt. 06:51.130 --> 06:53.950 And by that time, it's too late to learn lessons from it. 06:54.010 --> 07:02.950 And if that wasn't bad enough, there are a whole lot of people who wish that you wouldn't have privacy intuition, who hope that you won't be good at making good privacy choices. 07:02.990 --> 07:17.190 And those people often are the ones who are talking about digital natives, who want you to believe that whatever dumb privacy choice you made last week, you made because you have the mystical knowledge of how the internet should be used, and not because you made a dumb mistake. 07:17.210 --> 07:22.350 And those people, they tend to say things like, privacy is not a norm in the 21st century. 07:22.350 --> 07:26.110 If you look around, you'll see that young people don't really care about their privacy. 07:26.110 --> 07:31.730 What they actually mean is, I would be a lot richer if you didn't care about your privacy. 07:31.730 --> 07:38.250 My surveillance platform would be a lot more effective if you didn't take any countermeasures to protect your data. 07:38.510 --> 07:52.990 So it's really hard to get good at privacy, partly because it's intrinsically hard, and partly because we have a lot of people who use self-serving BS to try and confuse you about whether or not privacy is good or bad. 07:53.250 --> 07:56.250 Ultimately, privacy is a team sport. 07:56.250 --> 08:13.710 Even if you take on board lots of good privacy choices, even if you use private messengers, even if you use private email tools like GPG and PGP, even if you use full-disk encryption, the people that you communicate with, unless they're also using good privacy tools, 08:13.710 --> 08:20.090 all of the data that you share with them, it's just hanging around out there with no encryption and no protection. 08:20.210 --> 08:22.630 And so you have to bring those people on board. 08:22.630 --> 08:30.310 And that's where the fact that young people do care about privacy, even if they don't know exactly who they need to be private from, that's where this comes in. 08:30.310 --> 08:49.490 Because young people's natural desire to have a space in which they can conduct their round without their parents, without their teachers, without fellow kids looking in on them, that's an opportunity for you to enlist them into being more private, into having better control over who can see their data. 08:49.550 --> 08:53.270 So I'm going to leave you with a recommendation for where to look for those tools. 08:53.470 --> 09:02.370 Electronic Frontier Foundation, for whom I work, we have a thing called the Surveillance Self-Defense Kit, ssd.eff.org. 09:02.370 --> 09:05.770 And it's broken up into playlists, depending on what you're worried about. 09:05.770 --> 09:13.210 Say you're a journalist in a war zone, or maybe you're a kid in a high school, we've got different versions of the Self-Defense Kit for you. 09:13.210 --> 09:16.090 It's in 11 languages, so you can get your friends. 09:16.090 --> 09:20.430 If you come from another country, you can get friends in other countries to come along with you. 09:20.430 --> 09:31.910 And that way, you can all play the privacy team sport, and you can use your youthful curiosity to become better consumers of privacy and better practitioners of privacy. 09:32.010 --> 09:39.250 And then the internet that you inherit, that will be long dead and you'll still be living with, that internet will be a better internet for you. 09:39.310 --> 09:40.810 Thank you very much. 09:52.260 --> 09:57.560 Oh hey, so I just found out we've got free t-shirts from the Electronic Frontier Foundation. 09:57.560 --> 10:00.780 They're these awesome designs, they have all the best things from the internet. 10:00.780 --> 10:07.000 There's a cat, there's books, and there's CCTV cameras, which are all the things the internet has. 10:07.000 --> 10:12.760 If anyone has a question, the thing I will redeem the question for in addition to an answer is a t-shirt. 10:12.780 --> 10:15.000 So anyone got a question? 10:15.580 --> 10:16.800 Yes, go. 10:16.800 --> 10:19.720 Oh, they're smalls, but you may have a friend who could wear it. 10:19.720 --> 10:21.280 Or you could wear it as a hat. 10:21.400 --> 10:22.040 Go. 10:32.740 --> 10:35.660 Oh, how legal is it to decrypt Bluetooth packets? 10:35.720 --> 10:42.080 Well, you know, Roots has this amazing code of ethics that you can see over here that's about what you should and shouldn't do. 10:42.260 --> 10:46.920 And one of those things is you should be messing with your own data, but not other people's data. 10:47.180 --> 10:56.020 If you're messing with your own data, if you're looking at a tool that you own, like a Bluetooth card that you own and analyzing it, then in general, it's pretty legal. 10:56.020 --> 10:59.560 But let me tell you, there are a couple of ways in which this can get you into trouble. 10:59.700 --> 11:03.660 And the reason I'm mentioning is not to scare you, but to let you know that EFF has your back. 11:03.660 --> 11:09.220 So there's a law called the Computer Fraud and Abuse Act, the CFAA of 1986. 11:09.640 --> 11:13.820 And under CFAA, let me tell you the story of how CFAA came to exist. 11:13.820 --> 11:16.820 Do you ever see a movie called War Games with Matthew Broderick? 11:16.840 --> 11:21.740 So after War Games came out, people went like, my God, teenagers are going to start World War III. 11:21.740 --> 11:23.560 Congress has to do something. 11:23.560 --> 11:28.560 So Congress passed this unbelievably stupid law called the Computer Fraud and Abuse Act in 1986. 11:28.660 --> 11:35.900 And what they said is, if you use a computer in a way that you don't have authorization for, it's a felony and we can put you in jail. 11:36.200 --> 11:48.200 And so that has now been interpreted to say, if you violate terms of service, which is the authorization you have to use some website, you are exceeding your authorization. 11:48.300 --> 11:51.240 Well, like every one of us violates terms of service all day long. 11:51.240 --> 12:03.160 If you've ever read terms of service, what they say is, by being dumb enough to be my customer, you agree that I'm allowed to come over to your house and punch your grandmother, wear your underwear, make long distance calls and eat all the food in your fridge. 12:03.560 --> 12:07.760 And every one of us violates those rules all day long. 12:07.780 --> 12:13.080 And when prosecutors decide they don't like you, they can invoke the Computer Fraud and Abuse Act. 12:13.080 --> 12:19.440 Now we have defended many clients who've been prosecuted under the Computer Fraud and Abuse Act, and we will continue to do so. 12:19.440 --> 12:22.360 We're agitating for a law called Aaron's Law. 12:22.360 --> 12:26.080 It's named after a kid named Aaron Swartz, who was a good friend of ours. 12:26.080 --> 12:28.900 He was one of the founders of Reddit. 12:28.900 --> 12:30.640 He's an amazing kid. 12:30.840 --> 12:33.580 Helped invent RSS when he was 12 years old. 12:33.740 --> 12:46.740 And in 2013, after being charged with 13 felonies and facing a 35-year prison sentence for violating the terms of service on MIT's network and downloading academic articles, he killed himself. 12:46.920 --> 12:51.000 And so we've been fighting in his name to try and reform this law ever since. 12:51.100 --> 12:56.280 We're also involved in fighting to reform a law called the Digital Millennium Copyright Act, or DMCA. 12:56.380 --> 13:12.600 And the DMCA has this section called Section 1201, and it says that if there's a system that protects a copyrighted work, that tampering with that system is also a felony that can put you in jail for five years and see you with a $500,000 fine for first offense. 13:12.780 --> 13:28.680 And one year and two weeks ago, we filed a lawsuit against the US government to get rid of that law too, because it's being used to stop people from repairing their own cars, figuring out how their computers work, jailbreaking their phones, doing all kinds of normal things that you would expect to be able to do with your property. 13:28.900 --> 13:33.380 Now, in general, what you do with your Bluetooth device, that's your own business. 13:33.400 --> 13:38.580 But laws like the Computer Fraud and Abuse Act and the Digital Millennium Copyright Act, they get in the way of that. 13:38.580 --> 13:42.300 And that's one of the reasons EFF is so involved in trying to kill them. 13:42.400 --> 13:43.240 Thanks for your question. 13:43.240 --> 13:45.220 Here, take some textiles. 13:45.720 --> 13:46.600 Yeah, go ahead. 13:46.600 --> 13:48.900 And here, I'm going to come down so I can hear you. 13:56.500 --> 14:01.140 So the question was, what's my favorite science fiction question to write about? 14:01.140 --> 14:08.240 And so I'm one of a small but growing number of science fiction writers who write what I call techno-realism. 14:08.240 --> 14:26.760 So usually in science fiction for like 50 years, maybe even longer, whenever a science fiction writer wanted to do something in the plot, they'd just stick a computer in and say, oh, computers are able to do this thing or computers aren't able to do this thing to make the plot go forward without any actual reference to what computers could do. 14:27.120 --> 14:42.220 And, you know, I think that like 60 years ago when computers were the size of buildings and like 11 people in the world had ever used one, that was like an easier kind of magic trick to play without anyone figuring out where you hid the card. 14:42.300 --> 14:46.280 But today, I think a lot of people know how computers work. 14:46.280 --> 14:54.460 And so I like to write stories in which the actual capabilities and constraints of computers are the things that the computers turn on. 14:54.460 --> 15:07.380 And so, you know, we've got, like, I've got books like Little Brother that are 10 years old that people still read as contemporary futuristic science fiction, even though I wrote it 12 years ago, right? 15:07.380 --> 15:13.200 And that's because the things that computers can and can't do, theoretically, those aren't going to change. 15:13.200 --> 15:18.400 Maybe like how we use them will change, but the underlying computer science theory is pretty sound. 15:18.440 --> 15:21.180 And so that's how I like to work in my science fiction. 15:25.030 --> 15:26.610 All right, one over here. 15:26.610 --> 15:27.270 Yes. 15:35.810 --> 15:41.530 So the question was, how do you know when it's safe to share your information, when it's a good idea? 15:41.530 --> 15:43.190 Well, you know, that's really hard. 15:43.190 --> 15:45.910 Like, I make bad decisions about that all the time. 15:45.910 --> 15:55.750 Like, many times I've gone and made a choice to, like, give some data to a website or whatever, and then I find out that, like, that website, like Yahoo, right? 15:55.750 --> 16:02.030 Yahoo was compromised for five years before they told anyone that they leaked everyone's data, right? 16:02.030 --> 16:06.710 And so it's really hard to know for sure when to do that. 16:07.010 --> 16:19.010 I think that, like, some of it is just trying to remember what you thought might happen when you made a disclosure, and then comparing it to what happened. 16:19.270 --> 16:26.630 And some of it, I think, though, is that we need companies to be more careful with our data. 16:26.670 --> 16:31.010 And one of the ways to do that is to hold them to account when they make bad choices. 16:31.010 --> 16:38.010 So right now, like, a company that breaches all your data, generally they don't owe you any money. 16:38.010 --> 16:48.410 Home Depot breached 80 million customers' credit card records, and they had to give each of them about 33 cents and a six-month gift certificate for credit monitoring services. 16:48.630 --> 16:58.290 So, like, if those companies actually had to pay what it would cost their customers over that breach, then I think those companies would be a lot more careful with their data. 16:58.290 --> 17:08.570 So some of it is us getting better at making the choice, but some of it is the companies having to pay the cost for being part of that stupid choice, right? 17:08.570 --> 17:11.130 Thank you for your excellent question. 17:11.170 --> 17:11.670 All right. 17:11.670 --> 17:13.890 We've got two more t-shirts. 17:13.890 --> 17:14.630 Yeah. 17:26.740 --> 17:32.160 So the question was, how can other people get involved in fighting all these fights? 17:32.160 --> 17:39.480 So if you're on a university campus, Electronic Frontier Foundation has this network of campus organizations. 17:39.480 --> 17:45.680 If you email info at EFF.org and say that you'd like to get your campus involved, that's a thing you can do. 17:45.980 --> 17:48.740 Joining EFF's mailing list is really useful. 17:48.740 --> 17:57.700 We will send you targeted notices when, like, your lawmaker needs a phone call from their voters saying, get out there and make a good vote. 17:57.920 --> 18:01.800 Obviously, like, you know, writing EFF a check is a nice thing to do. 18:01.800 --> 18:03.460 You know, we're a member-supported nonprofit. 18:03.460 --> 18:06.700 We get our money mostly from small money donors like you. 18:07.300 --> 18:13.200 Making good privacy choices yourself and then helping other people around you make those choices. 18:13.480 --> 18:18.920 Having this conversation, you know, like, people say, like, oh, my mom will never figure out how to use this stuff. 18:19.120 --> 18:28.580 And, you know, like, first of all, it gives moms a super bad rap because, like, people design technology for the convenience of, like, bosses. 18:28.580 --> 18:34.980 Like, if a technology can't be used easily by, like, someone's boss, that person gets in trouble. 18:34.980 --> 18:39.800 If a technology can't be used easily by someone's mom, they're like, oh, my mom's dumb, right? 18:39.800 --> 18:43.680 And so, like, moms have to work, like, 100 times harder than bosses. 18:43.840 --> 18:46.820 And so, they're like ninjas compared to bosses. 18:46.840 --> 18:51.040 So, like, bosses suck at using technology, not moms. 18:51.040 --> 19:05.260 But there are people in your life, the kind of people who might come to DEF CON, who haven't really thought this stuff through, if you had this conversation with two people in the next month, you would triple the number of people in your circle who care about this stuff. 19:05.360 --> 19:05.940 Right? 19:06.740 --> 19:07.920 Thank you. 19:08.020 --> 19:09.220 Have a t-shirt. 19:10.160 --> 19:11.040 All right. 19:11.040 --> 19:12.360 Who's got the last question? 19:12.360 --> 19:14.420 It has to be really good, but no pressure. 19:15.840 --> 19:17.200 Yeah, hang on. 19:26.180 --> 19:31.480 So, the question was, he just got here, can I repeat the entire speech all over again? 19:31.480 --> 19:34.440 I can, but it's just the hash of the speech. 19:34.440 --> 19:36.180 So, it's really short. 19:36.300 --> 19:43.340 It's like 0-E-X-1-1-7-9-7-3-7-9-8-7-7-7. 19:43.340 --> 19:46.500 So, you can just compare that to the recording, make sure that hasn't been tampered with. 19:46.860 --> 19:47.680 All right. 19:54.360 --> 19:57.540 So, the question was, are any of my stories going to be made into movies? 19:57.540 --> 19:59.580 I've had a ton of stuff optioned. 19:59.580 --> 20:02.680 I've got a thing under option at Paramount right now, Little Brother. 20:02.700 --> 20:05.720 There's a Bollywood studio that has an option on my book, For the Win. 20:05.720 --> 20:08.020 But most stuff that gets optioned doesn't get made. 20:08.020 --> 20:12.020 It's that's like a pull process, not a push process. 20:12.020 --> 20:15.140 The author doesn't get to show up and say, now you make my movie. 20:15.140 --> 20:17.660 It's more like someone comes along and says, maybe we'll make your movie. 20:17.660 --> 20:18.920 And you're like, okay, give me some money. 20:18.920 --> 20:19.840 And then you wait. 20:19.960 --> 20:21.200 So, I'm just waiting. 20:21.580 --> 20:22.400 Thank you. 20:24.000 --> 20:24.400 All right. 20:24.400 --> 20:25.420 Thank you all very much. 20:25.420 --> 20:26.900 Have a great Roots.