start	end	text
60110	65110	Welcome everybody to Ask the EFF and Meet the EFA.
65110	71530	It is lovely to be back, sort of, at DEF CON for another year.
71530	76130	We've been doing Ask the EFF for, I think, since DEF CON 13,
76130	80830	taking your questions about the Electronic Frontier Foundation.
80830	85890	Welcome everybody to Ask the EFF and Meet the EFA.
85890	89890	It's lovely to be back, sort of.
89890	95390	Sorry, I had two things on our channel here, so I had to deal with the echo.
95390	99690	So, it's great to be here. We have an amazing panel for you.
99990	105430	And we will be going down the panel so you can get an introduction.
105430	108370	Let me introduce myself. My name is Kurt Opsahl.
108370	113650	I am the Deputy Executive Director and General Counsel of the Electronic Frontier Foundation.
113650	118930	And I am delighted to be back here. I work on a number of different things at EFF.
118930	123450	One of them is the Coders' Rights Project, along with Hannah, who you'll see shortly.
123730	129650	The Coders' Rights Project is where we provide free legal advice to security researchers like yourselves
129650	135310	when they have questions about legality of their research,
135310	139890	issues that may arise from disclosing it when a vendor gets upset.
139890	144330	And these are things that we often provide to this community.
144330	149650	But I always begin this panel with noting that this is not the time for those questions.
149710	153330	You need to have those conversations in an attorney-client-privileged situation,
153330	159270	which is not when it's being live-streamed to everybody at the DEF CON Twitch channel.
159350	165170	So, we're happy to ask questions, including questions about general legal principles,
165170	168290	but if it's about your particular situation,
168290	172030	and that includes when you're asking for a friend, but it's really you,
172730	175230	those are not the time to ask these sorts of questions.
175550	179110	But feel free to ask your more general questions.
180810	185410	And we can talk about, in addition to the Coders' Rights things, we have Hannah here,
185410	186990	so we'll introduce yourself in a second.
187250	193370	We also have the opportunity to talk about, well, one of the things that's come up lately
193370	202590	that Eva and I worked on TikTok and the ban, also expanding to a ban on ByteDance
202590	207050	and Tencent, the parent companies, a lot of interesting implications there.
207470	213890	You can hear a bit more about our activism work through Rory.
213890	217710	So, we've got a good show for you. Looking forward to your questions.
218070	220990	So, why don't we start it out with Rory. You want to begin?
220990	227990	Yeah, sure. Hey, DEF CON. I'm Rory. I'm the newest member of the EFF activism team.
227990	232350	And I came on in March as the grassroots advocacy organizer.
232350	237150	In that role, I work on the organizing team, which manages the EFA,
237150	241710	which is our nationwide network of over 70 local grassroots organizations.
241710	243610	I'm not going to spend too much time talking about that,
243610	246910	because you're going to meet them for yourself in just a little bit.
247750	253150	But the gist of it is, unfortunately, EFF can't be everywhere at once.
253590	258390	And these local groups really do a lot of heavy lifting for city and state level issues,
258390	261910	and are incredibly important for our success.
262510	267410	And I'm lucky enough for my role to be building a lot of these relationships with local groups
267410	272630	that are either currently members or potential members for the EFA.
272630	279330	And I'm actually lucky enough to come to the EFF and this organizing team from an EFA group myself.
279330	284050	I was a founding member of the CYPR collective, which you'll also meet in a little bit.
284390	289310	So I'm really excited to have benefited so much from this network.
289310	293510	And now I get to give back and help construct and build it further.
294050	297310	In addition to that, part of my background,
297310	301510	I care a lot about digital security for activists and LGBTQ plus communities.
301510	304330	That's very much part of my CYPR background.
304890	310710	I'm also technically still a grad student, but a former grad student and adjunct professor.
311170	315730	So I care a great deal about student rights and teachers' rights,
315730	320710	and concepts like open education, campus privacy, open science.
320790	327050	And then finally, we talk a lot about EFA being in kind of three buckets, unofficially,
327050	333360	of the workshop bucket, the advocacy bucket, and the makerspace or hackerspace bucket.
333750	338770	And it's that last one that I really am hoping to expand on moving forward.
338770	344970	We already have a lot of great hackerspaces in the EFA, including several DEF CON groups.
344970	349670	Shout out to DEF CON 201, 319, 313, and 919.
349670	355210	And then also artistic digital arts spaces like Eyebeam and NYC.
355210	359530	So I think it's really important that we expand into this creative territory,
359530	364430	because honestly, creativity and fun are a really important part of movement building, I think.
364430	367510	The old, if I can't dance, it's not my revolution.
368130	376210	And I think these issues of freedom of expression and play are one of the best ways to get people engaged in digital rights issues,
376210	382350	because you might not think about copyright or patent or DRM or right to repair or any of these issues
382350	387390	until it becomes a barrier between you and this really cool project you want to do.
387390	390390	So I think it's a really important part I'm hoping to expand.
390390	395410	So I think there's a lot of folks in the audience that are involved in those sort of projects.
395450	400730	I'll plug now. Reach out to me at Rory at EFF.org or organizing at EFF.org.
404070	406150	And then I guess we go to Hannah.
409950	414270	Hi, I am Hannah. I am a staff attorney at EFF.
414270	419070	I'm super excited to be virtually part of DEF CON.
419230	423170	I'm really looking forward to the day when we can attend in person.
423530	427590	But I, like Rory, I started very recently.
427590	433910	I only started in April. It's kind of an unprecedented time and a very unique time to be starting work at EFF.
433910	442130	There are a lot of issues that have come up in relation to the things that have been going around in the world in 2020.
442130	447050	COVID, of course, being one of the large ones, but also the protests that have risen up around the country
447050	458450	and indeed around the entire globe for justice, racial justice against police brutality and related topics.
458690	462070	My background is actually in criminal justice.
462070	470490	So I come from having practiced in criminal defense law for a number of years before joining EFF.
470490	476490	So as Kurt mentioned, I am part of the Coders' Rights Project.
476490	481030	And he already gave a really good explanation of that, so I won't go into it.
481030	485850	But needless to say that it is an important part of our work.
485850	494490	I, as someone who very long time ago in a different lifetime for undergrad had a computer science degree,
494490	502410	really appreciate the kind of work that we can do for independent security researchers, hackers, tinkerers,
502410	508470	anyone who's interested in poking around in systems and the like.
508470	517230	And recently at EFF, I guess my most recent cases, I've also worked a lot on police tech and forensic technology
517230	523190	because law enforcement and prosecutors use a lot of different types of technology,
523190	531110	from things like automatic license plate readers and facial recognition, which we hear a lot about,
531110	536910	to things that we hear slightly less about, like forensic probabilistic software,
536910	541630	which is supposed to do DNA analysis and match DNA of people.
541630	547870	And, you know, you hear these giant numbers like one in three trillion or something like that,
547870	551910	where people are matched. And actually there's a lot of issues with these technology.
551910	558830	And what we have seen before is that law enforcement, that these kinds of technology tend to be used
558830	563670	against marginalized groups and against the most vulnerable communities.
563670	571670	So we really should make sure that they're constitutional, that they're accurate, that they're not biased.
571670	574830	And if they are, they should not be used at all.
574830	582050	So I look forward to engaging with the DEF CON community and to listening to all your questions.
582330	583930	Thank you. Eva?
586560	591840	Hi there. I'm Eva Galperin. I'm the director of cybersecurity at the Electronic Frontier Foundation.
591840	601000	This is extremely not my first DEF CON. I have been coming to DEF CON since somewhere around the year 2000.
601220	609360	Dinosaurs were roaming DEF CON. And it was sort of in this setting that I discovered EFF.
609360	613940	Little, you know, sort of clueless teenage me went, hey, these guys seem to be the good guys.
613940	616220	I should do that one day. And then I did.
616220	626080	So I've been at EFF since 2007. And I have done, I don't even know how many of these Ask EFF panels.
626120	640640	But right now what I do is I run the EFF Threat Lab, which is a group of researchers who work specifically on issues that affect particularly vulnerable populations.
640640	653820	So people who are protesting, people in LGBTQ populations, people who have unpopular political opinions, people who are part of ethnic minorities.
654320	664580	We're interested in having their backs. And I don't know if you have been watching some of these DEF CON talks at the virtual event.
664580	676800	But my colleague, Cooper Quinton, gave a talk on his project, Crocodile Hunter, which had to do with tracking fake base stations.
676800	682000	And I strongly recommend that. It's based on the work that he did with our colleague, Yamna.
682280	691080	So I can answer questions about that. And also I can answer questions about TikTok and about general sort of privacy and security advice.
691080	699400	And how to reach out to people in a way that moves them to action, but does not scare their pants off.
702730	707590	All right. Well, thank you for that. So that is the introduction to our panel.
707630	714870	Oh, wait. Alexis is a little bit late, but still lovely to have you here. Alexis, you want to give an intro, please?
715710	727730	Hi. Sorry for being late. I'm Alexis Hancock. I'm a staff technologist at the EFF. And I've been around working at EFF about two years now.
727730	732350	So coming on my two-year anniversary, actually. Just now realized that.
732450	738850	I work on the project HTTPS Everywhere. And mainly that's my main focus.
738850	747210	But I also do research on other aspects of consumer privacy and how it impacts different populations.
747230	755910	So that's been my focus. And as of late, especially with COVID immunity passports, which mentioned verified credential technology.
755910	761070	So dealing with mobile identities research and how that may impact the general public.
762510	764550	And that's my intro.
766590	775870	All right. Well, thank you, Alexis. So that is our panel. We are now going to turn to your question. We've had a few questions come in.
775890	784530	So one question is, what is the strongest and most readily understood argument to support protection of end-to-end encryption?
784530	795290	We're talking with organizations, particularly non-technical audience, working to address controversial complex topics such as the transmission of child sex abuse materials.
796470	799250	So Rory, did you want to have something to say on that?
799450	807770	Yeah, definitely. So this is something that I think comes up a lot when you're engaging different communities on things like end-to-end encryption or even just the concept of hacking.
807770	812230	People have this very NCIS kind of concept of what that means.
812230	815850	That you must be like this shady character.
816010	824450	But what I usually like to pivot to is say, it's less about being shady and being on the margins, more about being on the margins.
825010	833930	That end-to-end encryption is really important. Yes, sometimes for people with nefarious purposes, but also people with very good just purposes.
835410	841210	The power of breaking end-to-end encryption or banning it is one that you have to consider.
841590	850430	Is that a power you want? You might be comfortable with the US president having, but are you okay with another foreign leader having?
850730	859850	Current leader, future leaders? And thinking about who is on the margin and who are we protecting with this technology?
859850	868550	And ultimately, everyone has the right to have that protection, right? It's part of being able to speak freely and live in a free society to have some privacy.
868770	879090	So I think that's usually a good hook for folks that are kind of just honestly perplexed by why anyone would support end-to-end encryption.
880590	894250	Thanks, Rory. To add a little something from my experience, I've been to a number of events or conferences where people from the organizations that are trying to stop childhood sexual abuse were present.
894250	900770	We talked about end-to-end encryption. And I'd say that they actually were understanding about the human rights concerns.
900770	911150	They have their very strong position. They want to be able to do whatever they can to stop child sexual abuse materials.
911630	929850	But I would say in terms of just talking about it, they were a lot more understanding that there were countervailing human rights concerns about breaking encryption than the government people who are at the very same conferences who are often using or pointing to those groups in order to support their arguments.
930270	945730	And I think they probably, you know, we're not going to agree on the ultimate path for encryption, but I think that they would say if there's a way to have, you know, great, strong encryption, you know, that is fine, so long as their needs are addressed.
945790	948370	But we can have the conversation, at least.
949550	953110	All right, we'll get to another one of your questions.
953960	963330	What would you say would be the difference between Congress interviewing Mark Zuckerberg in 2018 and Congress interviewing the tech giants a few weeks ago?
964350	969290	Anyone been following that? We don't have our alleged team on.
969290	975310	I did watch the antitrust hearing that came up recently.
975310	991730	I won't be able to speak historically to what our alleged team thought of the previous hearing, but from what I did, some eyes from my colleagues that watched both, Zuckerberg generally seems more prepared for these questions from Congress.
992510	1010770	Then normally, then the other CEOs that came through with the original intention of what the hearings are about are trying to see, like, exactly where are the PowerPoints that you can focus in on with these organizations and where exactly are they overstepping.
1010770	1026090	And the differences between the last one and this one, from what I surmised, was that they were just coming to terms with privacy issues and how the general public are worried about them with Zuckerberg and Facebook, Cambridge Analytica.
1026530	1039170	All those different types of like themes came up with his hearing in particular, and he seemed more strained then, and then this time around he seemed way more prepared than the other CEOs.
1039170	1048650	So the other CEOs had came and asked about this and we also want to call to the other previous antitrust hearing that Bill Gates attended two years back.
1048930	1062510	That the legislation team also mentioned, where that was kind of like the beginning of Congress's thought patterns on how to regulate and what to do when it comes to tech companies gaining such a mass amount of market power.
1062510	1076050	So I do suggest looking back at that hearing as well and seeing what people's opinions were on that, because that was kind of where it started, I believe, with Congress's thought patterns on what to do and what to ask when it comes to tech.
1076050	1097290	Mark Zuckerberg's hearing was very much so rife with people who didn't quite understand how the tech, and were asking questions that didn't necessarily get to the meat of the issue on why exactly Facebook has been nefarious, and why exactly Facebook's practices are a problem
1097290	1111850	versus understanding other things. That came up again at this recent antitrust hearing where a couple Congress members, or at least one I remember in particular, who didn't quite understand how spam email worked and kind of tried to like blame Google for that.
1111850	1129290	So that was pretty much what I saw from the recent hearings from Facebook's side. Apple was mainly quiet around the issues that we wanted them to talk about. But overall, I did like the round of questioning that did happen from some of the representatives on the Judicial Committee.
1129290	1147150	And they tried their best to grill them on the things that did matter at times, but then it's a balance between the different parties and what their intentions were. It seemed like the Republican Party was more focused this time around on censorship, and that's not antitrust.
1147150	1172420	So it went from good antitrust question to really bad sidetracked censorship question. So not focusing on antitrust was a real big, I think, pain point for a lot of people watching who really wanted them to focus on the antitrust portions of the questions. And that's my peripheral, you know, summation as a non-legislative person from EFF.
1173580	1194540	All right. Yeah, thank you. And go to our website to get more information because we have blog posts covering both those sets of hearings. So another question came in. Does EFF, as a U.S.-based organization, how does EFF, as a U.S.-based organization, see its role internationally? I think Eva got this one.
1194540	1213980	All right, I can cover this one. I worked as part of EFF's international team for many years. And EFF started out as an American-based organization. And this was largely because we saw ourselves as a group of people who primarily did impact litigation.
1213980	1233080	And so we had a bunch of U.S.-based lawyers because the U.S. is where most of the laws that were impacting the Internet or impacting the cutting edge of technology were being made and where the court cases were happening. And we are not entirely about impact litigation anymore.
1233080	1248480	And those cases aren't necessarily happening in the United States. You're starting to see them in European courts, in Brazilian courts, in Russian and Mexican courts.
1248480	1266300	The U.S. president apparently would like our Internet to look more like China's. And that is a fairly serious problem that requires an international approach in order to fix.
1266300	1288580	So having said that, what we did was we built an international team. We have people who do international law, who understand international human rights, who speak to the UN. We have people who are not based in the United States. We have people who go and talk to The Hague and to Brussels.
1288580	1313340	And also people who understand that the Internet isn't just the developed world, that the world is not divided up into the West and the rest, and that the rules which govern the Internet need to be fair, not just to Americans and to Europeans, but also to people in the Global South, and that their voices really matter when it comes to this conversation.
1313340	1341780	And often they're the people who get left behind when we talk about privacy and security, because they're the people who are using some of the slowest infrastructure, and they're often the people who are using the cheapest products in order to get online or to communicate. And often if you did not pay extra, then you are the product and you're essentially selling either your privacy or your security. We find that very alarming.
1341780	1366940	We also built a set of privacy and security guides, and we have those translated into eight different languages. We update them regularly, which almost no other security guide does. Everything has a date on it that tells you when, you know, this advice is good as of this date, and we translate it into languages.
1366940	1372020	So the Internet, in addition to being global, is not just English-speaking.
1374020	1394260	Thank you. Another question was, any advice for loosely federated national organizations working to simultaneously prevent doxing while preserving accountability, i.e. doing IAM for an organization where the national may not know or want to know all of the local's members?
1395820	1418420	Yeah, I could take that one. So it's a really interesting question. I'd want to know a lot more of the specifics before giving any kind of concrete advice, but I will say loosely federated national organization makes my ears ring a little because the EFA is a national organization of a network of people coordinating efforts.
1418420	1438420	So I think there's probably a lot of overlap. If you went to EFF.org slash fight, we have some really useful toolkits. So I think some sample suggestions would be establishing basic principles on the onset and maybe writing up like a simple mission letter and having those groups sign on to it.
1438420	1456540	I think where it probably diverges a bit is if you don't necessarily want to know the individual federated instances, particularly closely, that on our end, it's really important to build those kind of intimate relationships with our members and find these kind of intersections.
1456540	1473900	So maybe finding another way of communication among maybe more anonymized communication among the members of the Federation. So those are some things that come to mind. Definitely check out the toolkits. It's not exactly the same as coalition building, but I definitely see some overlap there.
1478000	1506260	Wonderful. Thank you, Goree. So the next question is from DC201. We are live streaming on the Crypto Barons right now and did a review of the article about California using blockchain to track people's COVID-19 status under a social credit system and a secure record. I want to hear straight from you guys your take. Keep up the good fight. Alexis, you've been working on immunity passport issue. What do you have to think about this?
1507680	1529860	Yeah, so actually the immunity passport work came directly from this bill. The bill in reference is AB2004. And that's been in play for a while and the EFF opposes it for several reasons. One of it is the fact that it's using a techno solution based practice towards a very, very loose dynamic situation.
1530640	1555820	Verify credentials, which is the technology mentioned in the bill, is for more static purposes and also immunity passports isn't something that is actually normalized for the general public to enter buildings, to enter their job, to enter venues or public spaces. This is not a practice that's been in play and the history in the United States with immunoprivilege isn't a good one.
1555820	1573220	So if you go back and look at the yellow fever in that position, you'll see that the United States has a very bad track record of handling immunoprivilege when you have a certain amount of population who can't exactly get testing at equal rates as other people in the population.
1573220	1587100	So not being able to update your status as much. We don't know, according to health experts, exactly how COVID works still. People are getting reinfected. There's other people out there with COVID who may be asymptomatic.
1587100	1610780	And we don't know how the antibody testing will be handled in the future. So rolling this out as a techno solution, using blockchain for the verified registry and a verified credential isn't necessarily something that calls to arms where you're building up something with a technology that claims it's going to be very secure and very straightforward, but at the same time, this is not a straightforward time.
1610780	1625020	COVID and immunity isn't a straightforward practice at the moment. So trying to build up something and say just because we're using encryption and just because we're using a secure tool doesn't necessarily mean the tool itself is good or the credential itself is good.
1625020	1643360	Basing people's immunity into a shared health credential with law enforcement or their employer puts people in very precarious positioning in our general public and that can exacerbate already the inequities that we have seen exacerbated during this pandemic.
1643360	1659120	And this would just add to the pile of inequities we have seen by making something like this the standard when we don't have, we don't even have a plan on like how we're going to handle sending kids to school.
1659120	1676180	So like being able to roll out something as COVID immunity passports, we're using blockchain. It's a very techno solution, Silicon Valley approach to something that we cannot just roll out something or an app or a technology and say we saw the pandemic, everybody go out and have a good time. That's not how this works.
1676180	1691800	So that's our take generally on it and we oppose this bill still and you will see more recent blog posts if you go on to the site and going over that again. We've written several times on this and hopefully they listen. And generally, I just want this bill to die.
1691800	1711280	And I don't want to see anything go through with this because I just don't think immunity passports or verified credentials or using blockchain for a verified registry is the solution to this. We're going to need a multifaceted policy-based approach to this pandemic and we can't leave it up to, oh, we use blockchain, everything's fine.
1717280	1731440	Thank you. And the next question is, what type of rhetoric do you think the forced selling and restriction of TikTok and other Chinese apps will set? Will network sovereignty be a philosophy we will have to fight in the near future?
1731440	1753840	So as it happens actually right before this, Eva and I were working on an op-ed to talk about the TikTok ban. And we've been actually looking very closely on the ban on TikTok and also on Tencent, the makers of WeChat, and also things like League of Legends and a 40% owner of the owners of Fortnite.
1754520	1783100	So this is a very, very hot issue here. And I think as far as from a legal and constitutional perspective, this ban is extremely troubling. The sanction authority that the president has invoked here has an exception for communications, including a implicit prohibition of communications, and a ban that would stop people from using TikTok would be exactly that.
1783100	1809400	It seems to be outside the statute. But perhaps more importantly, on a constitutional level, it is banning a means of expression that the power to say, you know, unilaterally with an executive order that the president could say, you can't use this particular communication channels anymore, you can't speak to the audience through that channel, has tremendous implications for free expression.
1809400	1826680	And it goes beyond what should be tolerated. Now, I understand like a lot of people also are concerned about, well, D, you know, but TikTok, they're gathering a lot of data, they've had some privacy scandals. But I'll turn to Eva to talk a little bit more about the privacy and security concerns.
1829050	1850430	So I'm not going to get up in front of everybody and tell you TikTok is totally safe. I will tell you that for the most part, it uses the same permissions and has many of the same security and privacy vulnerabilities that you see with similar social media apps.
1850430	1869730	The only difference is that TikTok is located in China, they are owned by a Chinese company, they have employees in China. They say they do not keep any US data in China. But the real question is, how much do you trust TikTok?
1869730	1895150	Is this what TikTok would say even if they were keeping US data in China, even if they were handing over all of the US data directly to the Chinese government? And I, for one, don't trust the Chinese government very much. Having said that, we are deeply opposed to the idea that the president should be able to ban an app via executive order.
1896150	1923990	There are a whole lot of legal problems with that. And it really sort of eclipses any kind of real conversation that we should be having about data sovereignty. Because after the Snowden allegations, one of the very first things that happened was the European countries started working on eventually becoming a GDPR and talking about data sovereignty in a much more serious way because they felt that they couldn't trust US companies
1923990	1948790	to not hand over data to the NSA. And they're right. And we should not be hypocrites who think that it's not okay for companies to hand data over to governments, unless it's ours, in which case it's totally fine. You know, we have rule of law and human rights and stuff. My willingness to believe in our rule of law and human rights is increasingly strained.
1950130	1975930	So I think, yes, we are going to be talking about data sovereignty. And one of the biggest problems we're going to have is that we are going to find ourselves battling xenophobes, people who are appealing to nationalism and to sort of anti-Chinese hatred as a way of knocking out the competition or lashing out at people who are not like them.
1975930	2001490	There are real concerns about TikTok, but these are not the concerns in question. The people who should be really concerned about TikTok are the people who are worried about having their data fall into the hands of the Chinese government. So if you are a Uyghur, if you are a protester in Hong Kong, if you're friends with a protester in Hong Kong, if you're a journalist who wants to protect your sources, and you have sources that are of interest to the Chinese government,
2001490	2021530	if you're a COVID-19 researcher or a Fortune 500 executive who is worried about having the IP for your company stolen, then, yeah, you should really be concerned about TikTok. But a full ban is absolutely not the answer.
2024070	2045950	All right, thank you. And just to add on to that, one of the aspects of this is it's balkanizing the Internet. It's sort of the notion of that there will be apps per country. And this is something that is very concerning. One of the benefits of the Internet is that it is a worldwide forum.
2045950	2071970	I can see people's real concerns about the privacy and security of data in other countries. And whether it is, as he was saying, the European Union was concerned about data in the United States. Brazil has been concerned about data in the United States. Of course, sometimes, I think like in the case of Brazil, it's not because they want to protect that data from themselves. They actually want the data locally, so they can be the ones spying on it instead of the NSA.
2072470	2090370	And I think the better solution to all of this is to just worldwide have protections against massive spying. Now, that is a hard job. It will take policy, it will take law, it will take technology. But the ultimate goal, I think, is to have a worldwide Internet that also has safeguards to protect privacy.
2090370	2104230	All right, we'll get on to the next question, which is, what is EFF's position on spyware, such as ProctorU, currently being forced on students for exams in some North American universities?
2105290	2107850	Hannah, did you want to introduce that topic?
2107850	2127850	Sure. Of course, and I know others will have stuff to say about ProctorU and other types of software like ExamSoft as well. But of course, what ProctorU and ExamSoft and all these types of software do is very concerning. Student privacy is incredibly important, especially since students...
2128630	2144770	The example I believe the questioner gave is at universities, in which case most of them are likely to be over the age of 18. But we know that some of these are also used in classrooms where the majority of the students are under the age of 18.
2144770	2172750	And that carries a lot of implications for their rights and what consent really even means in those situations when they're consenting to having their privacy invaded or to installing these apps and using them. It's also important to remember that these, just these programs, nefarious as they are, are not the first instances of how student privacy has been invaded.
2172750	2185870	We know that students use a lot of school-owned and school-issued devices, and we really encourage robust protection for their privacy for their uses of even school-owned devices.
2185870	2215850	This is just another example, I think, of invading the privacy of students, the ever-increasing encroachment into their private lives by having these software. And of course, some of these so-called software's functionalities are really the type of Trojan horses and spyware that we really rail against when they are from other companies and not ExamSoft.
2215870	2249100	And so, again, this is just another example of how students use a lot of school-owned and school-issued devices, and we really encourage robust protection for their privacy.
2249100	2280190	And so, again, this is just another example of how students use a lot of school-owned and school-issued devices, and we really encourage robust protection for their privacy.
2280650	2294530	Yeah, and I just wanted to quickly plug, we have a blog post recently about this on our website called University App Mandates are the Wrong Call, written by some of our colleagues. And it brings up some really important points I want to echo here.
2295210	2321350	One of the main things is these mandates, not just for crock-tarring apps, but for contact tracing and things like that, make a lot of assumptions about students that are problematic. For example, assuming their devices, a lot of these only work on Windows and macOS. Plenty of Linux users or even Chromebook users have complained about not being able to take their class because of those restrictions.
2321350	2348370	There's also plenty of concerns about accessibility. For example, when students have screen-reading software, it can become an issue to use these tools. And then just the broader issue of having reliable broadband and schools not offering an alternative to these online crock-tarring solutions. And then more broadly, it goes against all the stuff of open education that we know and love. Education should be easy and not infringe on your other rights.
2348370	2368370	To quote the blog real quick, universities should strike down any app mandates and should pledge to not include them in future student commitments. It's something that a lot of EFA student groups have reached out about so far. So I really encourage you to also reach out. It's something I'm very interested in pursuing.
2371290	2391190	Great. So another question we had was about... it's also on the international front. It was about whether there's an EFF affiliate in Canada. And so we're actually going to give you some background. Once upon a time in the mists of past, there were international electronic frontiers affiliates.
2391190	2418470	And in the 90s, the early years of EFF, we moved away from having an affiliate model. But we didn't kick people out, tell them to stop using the name. So there actually are a couple of electronic frontiers affiliates left. There's electronic frontiers Finland, I think is probably the most active chapter. There's also an electronic frontiers Australia, and I believe Italy is still somewhat around.
2418470	2432230	But we do not have an actual affiliate in Canada. But there are a number of organizations in Canada that we have worked in. I think Eva, you've worked a lot with some.
2434270	2450250	Citizen Lab, were you able? Yes. So the two that I was about to suggest are CIPIC and Citizen Lab. Citizen Lab is based out of Toronto, and they're all academics and security researchers. Highly recommend. We put out some research with them. They're great.
2450730	2461510	And CIPIC mostly does law and policy, which is good because the law and policy in Canada matters just as much as it does in the United States.
2461510	2464310	This is really important to us.
2469380	2476960	Very good. So another question we have in here. How does the US approach to privacy legislation impact your work?
2477280	2488320	I mean, sometimes it is the work, but is there any hope that it may be changing in the next five to 10 years? Is there realistic hope for any more GDPR style approach in the US?
2489180	2492020	Hannah, do you want to talk about eCPA and CALECPA?
2492020	2507880	Sure. So I don't know if there is any realistic hope for a GDPR style federal legislation, given the type of gridlock that we see currently in DC.
2507880	2515920	It doesn't seem like that kind of tension that prevents something like GDPR being passed will really dissolve anytime soon.
2515920	2524740	But what we know is that it is effective on a state to state level. So we do have the federal eCPA, which is Electronic Communications Privacy Act.
2524740	2530340	And it's supposed to protect electronic communications and the stuff that you send.
2530340	2539920	It is not nearly as protective as, for example, CALECPA, which is the California version of the bill.
2539920	2546600	And now the California law, CALECPA, is much more protective because it also provides a remedy.
2546600	2562700	That is a right for the person whose information has been wrongly collected in violation of this law to challenge it and have that information suppressed, deleted, which is not something that the federal law offers.
2562700	2568760	A thing that we always joke in lawyer circles is you will have all these laws that have rights.
2568760	2573280	But when they are violated, the laws don't tell you what you get to do. You don't get money.
2573280	2580760	So, for example, if you were wrongly convicted, you don't get any money from the state for the years that you spent in prison.
2580760	2587700	So you can have all these rights, but that doesn't mean that those rights come with ways to enforce them and to effectuate them.
2587700	2602360	And that's why something like CALECPA is such a monumental law. First of all, California being the largest or most populous state in the U.S., it affects a large number of people.
2602360	2607180	Second, obviously, the tech industry is centered in California.
2607180	2613580	And third, because it is the most protective law in the United States of its kind.
2613580	2631020	It requires that the government, any branch of government, so not just law enforcement, but any government entity, to have to comply with certain regulations in order to collect electronic data.
2631020	2642400	They can't just, you know, pass a law that says, okay, from now on, we can collect, you know, for example, schools can collect all this information about students.
2642400	2645080	There was some discussion on that.
2645080	2666360	And we actually have a case right now regarding CALECPA because the city of L.A. passed a law where it required all the scooter rental companies to provide real-time and historical movement data of every single one of their scooters.
2666360	2670160	And we are challenging it as a violation of CALECPA.
2670160	2675740	So it really demonstrates that privacy legislation can work on a state-to-state level.
2675740	2683500	So it's still very important to vote for your state representatives, your state assembly people, and your state senators.
2683740	2698440	And even if the D.C. will never see, or it is unlikely that D.C. will ever see a GDPR-style law in the near future or foreseeable future, it's still something that you can get passed on the state level.
2698440	2708480	Especially one where there may be state legislators who are interested in protecting this kind of thing.
2710220	2717000	All right. I'll just add a little bit on the CCPA, the California Consumer Privacy Act.
2717000	2721860	So what Hannah was talking about with ECPA is privacy mostly vis-a-vis the government.
2721860	2735040	But there also has been a consumer privacy law passed in California, which provides certain rights that are like GDPR.
2735040	2739060	It has a number of exceptions for smaller businesses.
2739280	2743720	It is probably not considered to be as strong as the GDPR.
2743720	2746200	It's not nationwide, of course, just in California.
2746200	2753060	On the other hand, a lot of the tech companies are in California, meaning that it does have a big effect on that industry.
2753500	2765720	Now, what's going on there is that the law went into effect at the beginning of this year, but there's also a proposition on the ballot in California that would replace the CCPA.
2765840	2774340	So I guess we will find out in November whether the CCPA will continue or will be replaced with something else.
2775340	2783720	And I totally agree that the GDPR-style thing at the federal level seems unlikely, at least for now.
2783720	2802040	Though one effect of the state-by-state process is if, as often happens, different states come up with different rules, that puts additional pressure on the companies to abide by the various rules.
2802040	2807300	And they become perhaps more receptive to having a national standard.
2807300	2821380	On the other hand, they will also, especially if they're like data brokers and such, will want to lobby to make sure that those national standards are a ceiling, while the privacy advocates would like to have the national standards be a floor.
2821380	2836020	That could become all the more important to be involved, which I think actually you can be involved through the EFA. Rory?
2838290	2843770	Yeah, if you're interested in being involved, please reach out to organizing at EFF.org.
2843770	2858910	We're always excited to have more organizations join the network. But also, if you're not directly related, if your group's a little tangential, but would like to be put in touch with another EFA group that is in the organization, you can see a list of them at, again, EFF.org.
2859870	2880510	Or email us and we'll put you in touch with some local advocates and get you involved. Again, base building, the more people on our side, the better. And especially for local issues, the EFF is only so many people with so many resources. EFA groups really help us address these really local issues as well.
2881870	2899370	And so there's lots of actually ways that you can get involved with EFF. So there's the EFA route, you'll get to meet the EFA. And we'll start that in about 10 minutes. There's also the Action Center, act.eff.org. You can go there and we'll try to help you get your voice heard.
2901610	2911390	And you can also get involved, a lot of you in this audience are probably coders, and you can get involved directly with our open source projects. Alexis, you want to speak about that a little bit?
2911390	2925190	Yeah, sure. There's several projects that we have right now that definitely, you know, we're always open to people contributing certain things, especially when you have a certain fringe case that you feel may apply to others.
2925190	2940750	When you bring things like that up in the repo, we pay attention, and we do our best to try our best to actually accommodate these scenarios and cases because we know people who use our tools are trying to stay safe online and private online.
2940750	2948910	So there's HTTPS Everywhere. That's a project that I'm the lead on. And we have Privacy Badger, which is another web extension that you all may use.
2948910	2957710	And we have CertBot, and we have Panopticlick. I don't think Panopticlick is open source, actually. It may be, but it's another tech project that we have.
2960350	2962510	People can find this all on GitHub, right?
2962510	2975730	Yeah, GitHub. And if you go on EFF.org under tools, I believe there's a whole menu that lists our tools that we have and the ways you can use them and how you can download them for yourself or get involved.
2975730	2985330	With HTTPS Everywhere in particular, we have community sourced rule sets for sites out there that may support HTTPS.
2985330	3002730	And a lot of those sites don't actually enforce it, as you may know. So a lot of our rules tend to those scenarios in particular. But if you could contribute to those projects and actually be able to contribute quite a bit of pull requests, we pay attention.
3002730	3017890	So people on HTTPS Everywhere project, actually, when they contribute over a certain amount of time, we tend to ask them to be rule set maintainers. And those are a higher level privilege of maintainers that help us in the repo and work together with us in the actual organization.
3017890	3026270	And we actually coordinate with our maintainers in HTTPS Everywhere. I can't speak to every project, but that's kind of like a little bit of how you can get involved.
3027330	3045530	All right, super. So another question we got here. Can I get free EFF swag like stickers? Well, we are a nonprofit organization. We are supported by people like you who help donate to keep the organization going.
3045530	3065850	And so we ask that people make a donation, and then we thank them for that donation with wonderful swag like stickers. But at fairly low donation amounts, you can get some amazing stickers at supporters.eff.org or just go to the website, the donate page.
3066670	3086250	And, you know, those costs, especially now when we can't be in person at DEF CON and just hand something to somebody, we have to ship it to you and such. So I think it would be great if you want to get some of those stickers. We'd love for you to have them. But if you just pop by the website and give a donation, we'd be happy to set you up.
3088150	3102930	And let's see, there's another question here. What kind of risks do non-California consumers have when posing as a Californian in hopes they could get CCPA rights?
3102930	3122930	I think in a lot of cases where you're asking to say I remove my consent or you're asking for the information, you can do that without really saying where you are from. And it probably would work out. But, you know, I can't recommend that you lie. You know, I can end up getting to a weird place later.
3122930	3145290	But you can probably get pretty far with just filling out the forms, saying you do not consent. And it is, I think, for a lot of the companies that are trying to be honorable about this, they are applying it on purpose, applying it to everybody.
3145290	3164010	This is more difficult for them to differentiate between one database and the other of California and non-Californians. Especially if you're a non-California, but you happen to be in California, you're still protected by the California law. It looks like if you're an American citizen and you are in the European Union, you are protected by the GDPR.
3164010	3182890	So it is a lot better for the companies. And I urge them to all to just try and be cool about these requests. And if somebody says, I withdraw my consent and you are relying upon that consent for processing their data, maybe stop. That would be like a nice thing to do and not be a jerk about.
3184260	3213740	All right. So what other questions? Any biometric data laws like Illinois' brewing in other states? So Illinois, they had a biometric privacy law. There was recently a, I think it was proposed 600-ish million settlement against Facebook for violating the Illinois biometric law, which is a, you know,
3214440	3239280	Facebook makes a lot of money, but you know, still 600 million. So you'd notice, you know, you still got to write it in up in the annual report. So it turned out to be a very powerful law, that case. And also that law is being used for a suit against Clearview, the company that scooped up all the photos they could find online to make a massive facial recognition database.
3239280	3250080	But I actually don't know, does anybody know if there are any similar bills moving forward outside of Illinois?
3253500	3258280	I guess not. We don't have a member of the ledge team on today's program.
3258280	3280240	So one of the things that we have seen a lot of for biometrics is facial recognition bans. These are usually at the municipal level. So there's a lot of municipalities that have banned their governments and especially their police departments from using facial recognition.
3280360	3286300	And a lot of the EFA groups have been supportive of that effort.
3286300	3306320	And this is, yes, CCOPS is the general name of it. Community Control Over Police Surveillance Ordinances, which is basically the idea that the elected representative, the city council, should have control over what surveillance techniques are being used or should never be used against their citizens.
3306320	3327020	And with, you know, all the police departments getting pressure to add more surveillance, getting funding from DHS to buy more surveillance, getting deals proposed by companies like Ring to get more surveillance installed by the consumers, it's very important to have these kinds of ordinances.
3327020	3345380	And again, the EFA has worked a lot with that. So maybe this makes this a wonderful moment to begin our transition over to the Meet the EFA portion of our program tonight. So I would like to please join me in thanking our panelists, Hannah, Rory, Eva, and Alexis.
3346020	3366540	It's been wonderful doing another Ask the EFF with DEF CON again. I miss you all so much. I wish I was there in person to say hello to you all. Indeed, indeed. But we will hopefully see you next year. And thank you. And then panelists, you want to say any last comments?
3369650	3370250	Thank you.
3370250	3375910	All right. Well, let's do the transition to the Meet the EFA panel.
3376610	3391010	Hello. Thank you, Kurt. And thanks to all of you. So yes, I'm Nash. I am the Associate Director of Community Organizing at the Electronic Frontier Foundation, where I lead the organizing team. Rory joins me also as well as a member of the organizing team.
3391010	3399450	And we help coordinate the Electronic Frontier Alliance, which is a network of over 70 community and student-led and grassroots organizations around the country.
3399450	3416890	So before we jump into that, I would just first join everyone else. Everyone in the chat has been really excellent about it. I also want to join them in thanking Alexis and Rory and Hannah and Eva and Kurt for everything that they shared. It's really an honor to work alongside inspiring folks like you and the rest of our colleagues at EFF.
3416890	3431790	I also want to thank everyone here who supported EFF. I see in the chat, there's lots of folks that are talking about, you know, the different swag and donations and support that you've given us throughout the years and that hopefully we'll continue to do the work that inspires you to do that going forward.
3431790	3439550	So thanks to all of you for the last 30 years and in advance for your support as we continue to fight for digital rights and free expression for decades to come.
3439550	3456810	And with that said, one of the things that I enjoy the most about my role at EFF is supporting grassroots and student-led organizations around the country that are working to preserve digital rights in their communities and empowering their neighbors with the information that they need to make informed choices about the way they interact with technology and the Internet.
3456810	3474770	So in this next portion of our time together, we're going to speak with representatives of four Electronic Frontier Alliance-affiliated groups. And then I think that the folks that are joining now would agree with me when I say that the work that they do isn't easy work, but it's work that all of us can be engaging in wherever we are.
3474770	3488390	It's great, folks like Eva and Kurt and Alexis and Rory, you're all brilliant experts that are doing inspiring work. But really, all of you are the experts in what the potential is and the ways to support and the threats in your own community.
3488390	3502490	So I hope that in addition to learning from the folks that we're going to hear from now, it may also inspire you to either join into the work that's already happening if there's a group in your community, or to launch a group that could also be joining them in that fight based in your area.
3502490	3517430	So welcome to the Meet the FAA portion of our session. And first person I want to introduce is Tracy Rosenberg. Kurt spoke a little bit about community control over police surveillance, and the local bans that have been passed on face surveillance.
3517450	3531910	And Tracy is, in addition to being the Executive Director of Media Alliance, is a member of Oakland Privacy. And Oakland Privacy was instrumental in passing some of the first and some of the strongest community control over police surveillance bans, as well as bans on face surveillance.
3531910	3549470	And so, yeah, so Tracy, Oakland Privacy really has a remarkable origin story, as well as a unique organizing model and stunning list of successful campaigns. Can you tell us a bit about Oakland Privacy's mission, and how the group was formed, and maybe divulge a little bit of the secret sauce that makes Oakland Privacy so successful?
3551190	3567930	Absolutely, Nash. First of all, I just want to say I'm sorry, my camera's acting up. So I'm going to go ahead and say a couple of things, and then hopefully I'll be able to see everyone in person as we work through the panel. Sorry about that. I don't know. Technology.
3568470	3588210	So Oakland Privacy was originally the privacy wing of the Occupy Oakland encampment, which as some of you probably know, is a fairly militant and fairly late Occupy encampment back in 2011.
3589210	3602510	Folks were basically wanting to sort of understand all of the equipment and devices and technology that was being used on them by the very many police that were in the proximity.
3602510	3614850	Once Occupy Oakland broke up, you know, you can never be too paranoid because we were doing PRAs and taking a look at stuff.
3614850	3634790	And we found a Homeland Security project called the DAC or Domain Awareness Center. It was a citywide surveillance gauntlet that essentially was about 30% of the way implemented and nobody knew that it was going on at all.
3634790	3649790	We mobilized the entire city. We stopped it in the spring of 2014. And then we devoted ourselves to trying to make sure that nothing like this would ever happen again here or anywhere else.
3649790	3676290	So we were talking a bit about CCOPS ordinances. And basically, we've been trying to implement that framework, which allows for reporting and consent, and when necessary, bans. And we are at about 11 or 12 cities nationwide. And I believe the 11th facial recognition ban just went into place last week in Portland, Maine.
3676290	3696130	Awesome. I'm so eager to learn. There's so much of that I want to dig more into. But first, I want to make sure we get a chance to speak with the rest of our panelists. And so the next person I want to introduce is Elliot from Cypert Collective. And Elliot is a motion artist and a creative coder who works in interactive fabrication and large-scale immersive experiences.
3697210	3721390	And Elliot blends visual work with an interest in mutual aid, security, and privacy online. And so it's funny, in Elliot's bio, it also mentions that Elliot is based in Brooklyn. Cypert Collective is one of the earliest members of Electronic Frontier Alliance, and they're based in Brooklyn. But I always think, as someone who's also from Brooklyn, I always think it's funny how, you know, when you're... it doesn't take very long to know when someone is from Brooklyn, because they tell you almost immediately.
3721390	3735890	And so I want to welcome Elliot to the panel here. And so thanks for representing Brooklyn, and thanks for all of Cypert Collective out there doing work to inform folks and give them the information that they need to make informed choices in their technology.
3736090	3743350	And we're all gathering right now in safe mode today because of the need to protect ourselves and our communities from the global pandemic.
3743350	3753710	But in normal non-COVID times, Cypert Collective puts on a range of workshops, socials, and other events. Elliot, why is that? Why not just stick to one format?
3754370	3760170	Well, I guess I should start by saying that I am from Brooklyn. Now that we've gotten that out of the way.
3760170	3761650	Brooklyn is in the house.
3761650	3777730	Yeah. It's the least I could do. So to your question, I think that, you know, a big part of Cypert's mission and what we've been trying to do over the last few years is to make security accessible to everyone.
3777730	3794630	And I think that that is key to why we have so many different types of events. Because, you know, we're trying to rather than kind of present one way to learn about security that some people might... it might work for some people and it might not work for others.
3794630	3800250	We want to have... we want to be able to meet people in the way that they're comfortable.
3800250	3814370	And I think that part of that is having a lot of events so that we can teach in ways that people are comfortable learning and also to kind of, you know, bring a social aspect to security and try and build a community around it.
3814370	3824550	I think all of which makes it easier for the average person to feel comfortable with and then being comfortable start to educate themselves about security.
3825330	3834290	Absolutely. I couldn't agree with that more. And so, next I'm going to introduce Abhi. And Abhi is with Black Movement Law Project. We use the abbreviation BMLP.
3834290	3849750	And in full disclosure, Abhi and I have worked together for a number of years. And in fact, after years of doing legal support work in a range of contexts, Abhi, also International Human Rights Attorney Nicole Lee and myself started BMLP to support the building of Black-led legal support infrastructure in the US.
3849750	3859130	And it was actually Abhi's idea, way before I joined the team at EFF, for BMLP to join the Electronic Frontier Alliance and for us to do our first round of digital security workshops.
3859330	3867830	In addition to work with BMLP, Abhi is an attorney and technologist. He's currently a partner at O'Neill and Hassan LLP, a law practice focused on indigent criminal defense.
3867830	3883550	And prior to his work with BMLP and some of the other work that he's engaged in right now, he was the Mass Defense Coordinator at the National Lawyers Guild. Shout out to National Lawyers Guild and all the work that they're doing across the country to support folks that are raising their voices to call for justice and an end to police violence.
3883850	3895310	And Abhi has also worked as a political campaign manager and strategist, union organizer, and community organizer. And Abhi conducts trainings, speaks, and writes on topics of race, technology, injustice, and the law.
3895310	3905110	Now, Abhi, a lot of the EFA groups fit into one of three boxes, or some of them span, like Lucy Parson's lab does digital security trainings, as well as advocacy work.
3905390	3913510	But those boxes generally fall into ones that are popular, like Cyber Collective, that focus on popular education about technology and privacy.
3913630	3920590	There's also Hacker Spaces. I know there's folks in the chat right now from Crash Base in Los Angeles. Thanks, y'all, for joining us and all the work that you're doing out there.
3920590	3929250	And then there's also the Hacker Spaces, where folks are sharing tools and skills and resources, and obviously the advocacy groups like Oakland Privacy.
3929330	3939110	But BMLP is a bit of an outlier. As the movement is changing, and what are some of the ways that movement law can expand to meet the need of growing social movements?
3939110	3951650	And why is, for a group like BMLP, that is focusing on, you know, providing legal support infrastructure to support folks that are engaged in first amendment protected activity, why is digital security and privacy important?
3951650	3955610	How did that become such an integral part of your work?
3958090	3964250	Yeah, so, yeah, thank you, Nash. Thank you for the very nice introduction.
3964250	3981970	Look, I got to preface this with saying, none of us know what we're doing, right? We're in an unprecedented moment where we all have to rethink and be on our toes and be flexible in how we're engaging with everything, right?
3981970	4002170	And so that, you know, that's my disclaimer, but like, you know, as far as the work that we've done, you know, we, like, as you mentioned, started doing this kind of legal support movement, legal support work, specifically, you know, in 2015-2016.
4002170	4029830	And we just, you know, responded with kind of the grassroots calls we got for, I mean, we joined the EFA because people were asking us about digital security. And so we had to develop a digital security plan. We partnered with EF, with EFF and helped with, you know, EFA and all of the, like, really great work that EFF has been doing to build on that digital security training infrastructure.
4029830	4056930	But like, now we're in this point where it's like, you know, I want to, I think that that space of digital security training has grown. And like, you know, because of CYPR, EFA, EFF and other organizations, it's like, that space has grown. And I think that we need to also start expanding what we're doing as movement technology people, like, and start thinking bigger, right?
4056930	4079870	Like, also, like, we need to do that, that kind of core organizing work and that core digital security work. But I think we also need to think about how we're building at a different level, movement infrastructure, how we're building at a different level, the types of, you know, how we incorporate technology in a holistic way with how we build movements.
4079870	4107910	And like, that is more than that, that is a big project. And so that's kind of where I see us going, where we're like, not, we're thinking about how we can build mass scale infrastructure and how we can, and how we can engage just at different levels more than just that digital security level.
4107910	4114510	And so that's kind of where I want to see us going. And that's what I hope BML can be part of building.
4114790	4127010	Yeah, and I appreciate, you know, speaking of in terms of movement and encouraged in terms of the ways that that work is essentially to support work that people are doing to knock down systems, you know, traditional systems of marginalization and oppression.
4127410	4135790	And that part of that is making sure that they're able to keep their information and their communication secure and that technologists are communicating in effective ways with the folks that are doing that work.
4135790	4148370	In keeping with that, actually, it's a great opportunity to introduce Emily St. Pierre, it's really my honor. And Emily is the security ambassador for FutureAda, a Spokane-based nonprofit advocating for diversity and inclusion in STEAM.
4148490	4153430	I don't think I need to tell folks here, security, technology, engineering, arts and mathematics, this is DEF CON.
4153690	4162250	For the past six years, Emily has used her experience as an offensive security professional to provide privacy and security education within her community.
4162250	4174350	Now, through Emily's work with FutureAda, Emily has established free regular workshops and one-on-one technical support to the Spokane community, so folks in Spokane, Washington, definitely look out for FutureAda.
4174350	4182270	Now, Emily's focus has been to make sure that these resources are explicitly available to underrepresented and under-supported members of the public.
4182370	4188770	Now, Emily, FutureAda is one of my favorite names in the Alliance, to be honest. Don't play favorites, but it's one of my favorite names.
4188770	4196090	Can you start off by telling us a bit about the significance of that name and what need in your community FutureAda was launched to address?
4196870	4201750	Thanks, Nash. I have to say, speaking of favorite names, I love Cypher as well.
4202950	4211430	So, FutureAda is named after the Countess of Lovelace, or Ada Lovelace, who was a mathematician and a writer.
4211430	4221370	She's often recognized as the first computer programmer. And FutureAda was founded by my wonderful colleague, Rebecca Long, in 2017.
4221990	4238370	And so, after facing, you know, many challenges in the industry, in IT, you know, she had a vision to start a nonprofit, which would help promote, you know, diversity and inclusion, you know, within those areas of STEAM, as you mentioned.
4238370	4258230	And this is all in the hopes, you know, of helping the future Ada Lovelaces of tomorrow, you know, realize their potential, no matter their background, no matter how they identify and present themselves, you know, everyone deserves to be and feel included and to thrive within the areas of STEAM.
4258230	4278610	Our nonprofit also puts on and participates in events to help promote interest in these areas around Spokane, Washington, and sometimes Coeur d'Alene, Idaho. And my role as security ambassador is really to, you know, first and foremost, promote interest in privacy and security within our community.
4278610	4295230	And, you know, secondly, to provide access to privacy and security professionals to underrepresented groups, but also, you know, we are open to the general public, because we feel that security and privacy is something that should be available to everyone.
4296030	4324410	Awesome. Now, Emily, you know, given that we are here at DEF CON, I have a question for you in that, like, what are some of the things in your experience and given your unique perspective, what are some of the things that folks in the hacker community and folks in DEF CON could, like, what are some things you'd like to see them doing and being able to support the work that you're engaged in and some of the other work to give folks the information and power to be able to engage responsibly with their tech and the larger sector?
4325230	4337430	Yeah, that's a good question. I thought about that a lot this week, you know, and I'd love to see hackers building more bridges with other communities outside of InfoSec.
4337430	4367250	You know, I've seen amazing projects come out of these types of collaborations, such as, you know, this paper presented at the USENIX Security Symposium last year by Sam Haven, and Haven and other researchers, you know, from Cornell Tech and NYU, they came up with a model where security professionals, you know, are integrated into the support infrastructure, you know, for victims of intimate partner violence.
4367250	4381850	So they can help, you know, those victims or clients, as they call them in the model, they can help them assess whether or not their devices or accounts are being used or have the potential to be used for surveillance, you know, by their abusive partner.
4381850	4391550	And we love that model so much at Futurada that we actually implement kind of a version of it to all of our, you know, one-on-one consultations.
4391550	4421250	And if there's anything I can do to, like, I really want to encourage, you know, everyone who's listening to be a security and privacy advocate, you know, and you can do that by, you know, volunteering, you know, and there are plenty of organizations around you that would benefit from having a professional work with them to help them understand and address their privacy and security concerns, kind of like the example I just talked about, you know, and that can be, you know, your local youth center,
4421250	4437430	your local shelter, you know, any organization nearby. And if you don't have time, you know, to volunteer, you know, even doing something as simple as having conversations about security and privacy with people around you.
4437430	4461270	Not only will that be a great opportunity to teach folks about these topics, but it will help you learn about and better understand threat models and privacy and security needs that you may not be aware of. And I really want to encourage everyone to that. So not just help teach, but also help understand and listen.
4461970	4476970	Thanks, Emily. And so that actually, and one of the things that the Alliance does is creates an opportunity for groups that are working across the country to be able to share skills and tools and resources in that way, so they can be more effective at being that person in their community.
4477270	4487330	So I think that gives us an opportunity to address one of the questions that came up in the chat, and which is, the question is, can I make my college's cybersecurity club an EFA group?
4487330	4499710	And I can answer that. And I can say, yes, if you have more than three folks, and you have openly accessible meetings that create an opportunity for folks to connect and support the work that your group is doing.
4499770	4509270	Obviously, in, you know, before March of this year, that meant like having an opportunity, you know, having a space where folks could come and enjoy a training or meet and connect with folks.
4509270	4514930	Now we have to obviously be much like, you know, the safe mode of DEF CON, be a lot more creative in how we create opportunities for that.
4514930	4524530	But I want to ask, so I hope that that's answered the question around, can someone make their college's cybersecurity club an EFA group? Absolutely, reach out to us at organizing at EFF.org.
4524530	4533210	Check out EFF.org slash fight to find out more about the Alliance. But I also want to, like, kind of rephrase that question and put it out to the panelists here.
4533570	4539170	And, you know, what were some of the things that, like, why did your group decide to become a part of the Alliance?
4539170	4550050	And, you know, what was the, what, how did you, how did you, I know it's like cyber collective organizes like very horizontally, right? And so they work in a way that, you know, make sure that everyone's voice is heard in the decisions that they're making.
4550090	4564750	So I'm curious, you know, what was the, you know, if you have some insight into how your group decided to join the Alliance, but also, like, what are some of the things that the opportunities, benefits and reasons that you might, if someone was asking you if they should join the Alliance, what are some of the things that you would share?
4564750	4569290	And so maybe I'll start off with you, Elliot, and then we can work around.
4570990	4590510	So, I mean, I think it's a big topic, but I think that one of the reasons we wanted to join the EFA was to kind of expand upon sort of one of our organizing principles, which is, you know, a big thing that we've always tried to do is be big and have collaboration be an important thing.
4590510	4610590	So that instead of us just saying, like, you know, we kind of have this knowledge and we're just pushing it out, sort of not so sensitive to the context or accessibility or any of those things, have kind of it be more of a sharing process that allows for a lot of collaboration and allows us to learn as well.
4610590	4631310	And I think that, you know, the opportunity to join the EFA really gave us an opportunity to collaborate with a lot of other fantastic groups around the country and the world. And so in that way, we saw it as just sort of a natural extension of what we were trying to do at the local level.
4632050	4643850	Thank you. Tracy, I know Oakland Privacy was in the Alliance before I started at EFF. And so I'm wondering, how did the Oakland Privacy originally become part of the EFA? And what's that relationship been like for y'all?
4649270	4661250	We may have lost Tracy. I know Tracy was having some problems with the camera. So maybe I'll pass that question to Emily before I've got another great question I want to ask Abby. So I'll pass it to Emily. And then, yeah, what are your thoughts?
4661250	4688550	Great. So we joined the EFA because we, you know, there's plenty of smart and creative and wonderful people part of the Alliance. And so we knew there was so much we could learn, you know, from other folks and other organizations. And we definitely have. You know, I definitely was not as well-versed in activism until we joined the EFA.
4688550	4713450	And I've learned of so many different resources, thanks to being a member. And we're also, Oakland, Washington is pretty small. Not everyone knows where we are. Like, we're a pretty small community. And it's really helped us, you know, get our message across and, you know, tell our community about, you know, everything that we offer, the workshops we offer. So it's been really helpful for that.
4713450	4728270	And along that lines, and finding out more about Future AIDA, keep your eyes out for a blog that I'm going to be releasing soon with a profile on Future AIDA and the amazing work that they do. And so it sounded like, Tracy, you sound like you're back on. Did you want to add, did you want to speak to Oakland Privacy and EFA?
4729090	4755230	Yeah, totally. I think what's been exciting for us about EFA is just seeing so many models in terms of how people do work. Because the challenge, of course, is that one way or the other, you're a fairly small collective, and you're dealing with these big, heavy, weighty, important issues and challenges.
4755230	4783870	Really, you know, everything about internet freedom and digital security. It's a huge range of issues. And there's so many different and interesting and creative ways that sort of groups of people get their mind around sort of how to tackle it and how to approach it and what to do first. And EFA is really just like an encyclopedia of what, you know, five or eight or 10 people can come up with in terms of, okay, what should we do first?
4785330	4807510	Thank you. Yeah. And that's actually, that's the favorite, my favorite part of the job is like working with folks to figure out like what is going to be not, you know, not that like, it's like a one size fits all, like what we did here is going to work there. But like, how do we take lessons that were learned in one area and be able to figure out how they can adapt and be most effective for a different community in the context of that community is working in. So absolutely. Thank you, Tracy.
4807770	4811910	Avi, I'm going to give you a different question. Did you want to speak to that one? Because I want to give you a different question.
4811910	4825890	Just real quick. I just want to say that that's really like people who are thinking about joining EFA and getting involved and trying to apply their technical skills to larger political projects.
4825890	4838710	I think it's crucial to understand that like the skills you develop, if you're actually doing threat modeling, if you're actually doing analysis, you are actually doing a form of political analysis as well.
4838710	4851750	You are doing an act like if you're doing a good threat model, you are doing a material analysis of the like organizational and institutional opponents to like human freedom, basically.
4851750	4858770	And so like you really like you, again, I want to warn the tech people, you don't actually know it all already.
4858770	4878670	But like you have if you've developed those skills, you've developed some insight and the ability to collaborate and coordinate with more overtly political organizations and apply those like actual material reality assessing skills can be incredibly valuable, especially
4878670	4886890	if you approach it with like a kind of like humility and openness, you know, so that's all I'll say about that.
4886890	4897770	Yeah, no, that's right. And when you're saying that it made me think about the security education companion, which is like a really an example of a tool that we were getting at EFF, we were getting lots of folks that were asking us, especially, you know, following the last
4898150	4904610	presidential election cycle, that were concerned about the impact that there was going to have on their communities and want to make sure that folks had information.
4904850	4915090	And we thought about, you know, what could EFF just like, you know, parachute into different communities and have the answer and be able to provide it. And we realized that that wasn't a responsible or sustainable model.
4915090	4929090	And so we have, with help of groups in the EFA, have developed the security education companion, which helps folks that are either maybe great teachers and facilitators but need some help in making sure their trainings effectively convey the intricacies of the technology,
4929090	4941090	or the other way around where they're technologists and need help to be able to adapt their pedagogy skills and what have you. And so security education companion is also great. So if you're in your community and want to be a resource for folks in your community,
4941090	4953010	that's a great tool and resource. And Abhi, the question that I want to ask you that fits right perfectly on top of that is, how would you recommend, this comes from the chat, and so I'm going to read it the way it's worded.
4953010	4965270	How would you recommend those of us who may not be members of the communities that most need security, i.e. cis white males, build trust and truly collaborative relationships with communities who most need security?
4967750	4984850	I mean, you know, that's a tough question. I mean, I don't think there's one answer. I think building off what I just said, it's kind of like, it's really about how you approach the issue, right? Like, what are you, like, again, like, you have something to offer, you have something to learn.
4984850	4993470	And if you approach things with that perspective, you know, you're going to do much better than if you approach things from the perspective of I know everything or whatever.
4994210	5015050	But, you know, I think that the name of the game is, is how do we build solidarity, right? How do we build relationships and networks that are collaborative, like across different identities and different communities, right?
5015050	5033690	I mean, like, if we're all completely siloed forever, we will be divided and conquered. I mean, that is just, that is, like, almost a fact of history, right? So, you know, there's not one simple solution to that conundrum, right?
5033690	5055030	But I do think that, like, building long lasting relationships, sustaining relationships, approaching the work with humility, approaching the work with, like, an interest in learning and like, but also approaching the work as, you know, it's a hard line, right?
5055030	5076570	How do you, how do you approach work as an equal, but also recognizing difference, right? That is a hard thing to figure out, because, like, you know, I think that we often get caught up, like, it wasn't allies that won the Civil War, right? It was warriors, it was fighters, right?
5076570	5101610	Like, we need, like, actual people engaged in actual struggle. We don't need people on the sidelines. But we also don't need people telling us what to do and domineering and dominating conversations. So, you know, being very conscious and open and engaging in that struggle, even internally and with other people and hashing it out and being open and honest about what you don't know.
5101610	5111270	Like, that's, that's the only, that's all I can say. It's like, constantly engaging, constantly questioning, and constantly building networks and relationships of trust.
5111610	5112590	Gotcha.
5112590	5125650	Yeah, I mean, obviously, I've worked, I have worked really closely together and have challenged this question together. And so I absolutely couldn't agree more with what Abhi shared.
5125650	5151830	Cypher Collective has an interesting thing that they do. And I'm hoping, Elliot, you'll speak a little bit because I think that's one of the things about creating that trust and an opportunity to, for folks to share kind of, like, the things that they're most concerned about and, like, their, and their things that they feel the most vulnerable about is, like, creating a space and an environment that, that, that makes that possible, that helps create a comfortability and an affinity to foster that.
5151830	5165970	So, and I always, whenever I think about creating that environment, I think about security. And so I'm hoping maybe you'll share a little bit about what that is and why that model is effective that way, if it is effective that way. I think it is, but I want to hear from you. It's your event.
5165970	5182790	I think it can be effective. And I think security and also a lot of other events that we have, they kind of all share in common that, you know, well, I think the overall topic might be security and definitely is security.
5182790	5198090	It isn't sort of the only thing that we do. And I think that one of the reasons, you know, like at some points we have security and the whole session might not even be about security at all. And then, you know, we also have movie nights, you know, where it might not even be discussed.
5198090	5215230	And I think that the reason we do that is to create a community, but I think that something that people should be aware of is that many of us come to security because we find it to be something that's intellectually interesting, or, you know, we have kind of a general moral feeling about it.
5215230	5226550	But I think that something that's important to realize is that many people come to security workshops, because I guess to put it in the most simple way, they've had something bad happen to them.
5226550	5242990	You know, it could be, as was mentioned earlier, intimate partner violence. It could be that they feel like the place where they work or the place where they go to school has taken advantage of them or made them feel vulnerable.
5242990	5268710	And so it's coming from a place where people already have had something happen to them that gives them a problem in trusting people. And so I think that, you know, many of the things that we do that are more social are for fun, but I think it's also sort of, you know, to build an important relationship with people so that they feel comfortable really opening up about, you know, what they're looking for help with.
5268710	5276750	And so I think that that is kind of why we try and do the range of events that we have to help people feel comfortable and build trust.
5277430	5288890	Thank you. And so we are at time, but I want to give everyone an opportunity to kind of like leave with their closing message. And so I'm going to go around the way y'all are on my screen, which is Tracy, Avi, Emily, and Elliot.
5288890	5304090	And so Tracy, I want to give you an opportunity, especially since Oakland is such a diverse community and y'all have done such amazing advocacy work there. If you want to build on to the question around like how building that trust and building that affinity and maybe even saying something about building coalition.
5304090	5317470	And so if you want to talk to that and also like what is like the one thing that like if folks were wanted to wanted to to recreate or to model the work that Oakland Privacy has done in your community, what's the like the most important message you would want them to take?
5318730	5319570	Right.
5319910	5329170	Um, I think the most, well, the simplest thing that I could probably say is that, you know, the trust of your community is everything.
5329170	5352650	We did a lot of listening. We did a lot of, um, you know, what do you want to see happen here? And we really saw ourselves as kind of the advocacy consultants, not so much, um, not so much coming in with a solution, but coming in with a here's what the community wants.
5352650	5364890	And here are some tools that we can provide to sort of help us get to where we want to be together. And as we go out of Oakland to other places, that's even more important.
5364890	5384530	And so we just kind of try to look for the advocacy opportunities, the thing that's happening that gives us an opportunity to sort of step up and say something and then sort of turn to the locals in partnership and say, um, you know, here are some things that we can try to achieve the goal.
5384530	5402130	And the goal is, is almost always we want to have an impact on what happens. And when it comes to stuff like the spread of surveillance, it's, it's, it's all about consent. We want them to ask us and we, and we want the opportunity to say no.
5403810	5421490	Absolutely. And yeah, and so and again, like the Kurt mentioned earlier, and Tracy's touched on it, and really like the community control over police surveillance ordinances are very much, you know, banning face surveillance, because face surveillance, even if it worked perfectly, the First Amendment and Fourth Amendment implications would be, would be too to stop, to stop the harm before it grows.
5421790	5428990	But with the others, with the other surveillance equipment, it's really about making sure the power goes back into the community to have a voice in it and for their elected officials to make the decision.
5428990	5438610	And so really thanks to Oakland Privacy for all the amazing work that you've done making that a thing, not just in Oakland, but in many cities, and with the support that you've given to folks throughout the Alliance and throughout our neighboring communities.
5439050	5451390	Avi, what is like, what is the, what is, you spoke a lot about technologists facilitating and helping, working, build, building the tools and developing things to support folks that are engaged in movement work.
5451390	5461410	If there's one thing that you want folks who are thinking about engaging that work, could like, what would it be? And then if you want to, we had one question I didn't get in, I didn't get a chance to respond to.
5461410	5470530	So this will be an optional, this will be bonus points if you want to talk a little bit about the successes and failures of the GDPR in the limited time that we have. Go!
5470530	5490750	Okay, look, so, you know, you said one thing, I'll give you three. I mean, like, I think you, one framework that I find useful to looking at this is, you know, I'm going to preach a holy trinity, right, of movement work, right, or of, you know, it's the holy trinity of time, space, and information, right?
5490750	5513010	Those are the three things that we can look at, look at everything through, right? And so when we're approaching the work, what of those three can we offer and what can we bring to building, right? And they're all kind of work in a dynamic with each other, where if you have more space, you can kind of have less time and, you know, you can actually have more information, right?
5513010	5536750	Like, they all work kind of together. But, like, thinking about, like, what, how we're engaging through that lens, I think, is very helpful in thinking about how we build because, like, that's how we create the bricks and mortar of building organization, of building movement, of building all the things I said before about networks, connections, and that's what we need, right?
5536750	5554530	Like, our kind of opposition or, like, the forces that are working against us have those things in spades. And we are very lacking, especially in any kind of holistic vision of how we have those three things working together. So that's kind of time, space, information is my holy trinity.
5555310	5580370	Thank you. And Emily, I really, I think that you, yeah, I don't think there's enough praise I could get to the work that Future Aid is doing. And also the work that you're doing pre-COVID and with COVID and trying to also not lose count of the folks who are not able to connect, like, virtually, right? Folks that, like, when you were doing events and libraries, it was easier for them to connect and to be able to do that work.
5580370	5604850	And so the fact that you're keeping, you know, you're thinking about who's not in the room is really important, right? And so I really want to, like, lift up that work and say, if there's anything that you could offer to folks around, like, being able to do that work effectively and being able to center the folks who need it the most effectively in their communities, if there's some suggestions or guidance that you can offer there, we'd love to hear it.
5604850	5621610	Yeah, absolutely. You know, I think there's a lot of organizations around you that, you know, have also, you know, done their work of understanding what are the some of the issues within the community that they also wish to address.
5621610	5648650	And so to kind of cross-pollinate with other organizations will be a great way to learn really fast and effectively some of the issues that, you know, might be going on that you need perhaps maybe more of an expertise, like, on from someone else or you want, you know, a little bit more depth or understanding of an issue.
5648650	5667570	And so to, I've really come to depend on my communications with other folks that do great work in our communities to ask them questions to learn and to see also kind of how we can address issues that I hadn't thought about.
5667570	5693630	And just to be that open line of communication when they need, you know, objective security and privacy advice, as objective as I can humanly give, you know, so that they don't have to get it from a source that might be a vendor or just like not, you know, it's not an information security professional. So I do advise to do that if you can.
5693630	5710850	Absolutely. Coalition building and working directly with the folks who are impacted and recognizing that, you know, you don't have to reinvent the wheel every time. You have to figure out the way that you can be most supportive in the system that's there to provide the support for folks. So thank you so much, Emily.
5710850	5739650	And Elliot, I want to give you an opportunity to like whatever you think that folks should leave knowing about CYPR, but I hope that you'll also talk a little bit about one of the things I really like about CYPR is the focus that y'all put on making learning accessible. So I was wondering if there's any guidance you could leave for, you could also offer to folks that would want to replicate CYPR's work around how to at least be thinking through making sure that the work that you're doing is accessible for the broadest breadth of your community as possible.
5740170	5764690	Yeah, totally. I think that, um, I guess I'll say two things about that. And then just one thing sort of in response to what other people have said, kind of agree with them. I think that if there's two things that help and are important to making something accessible, it's first, don't feel blocked into or limited to trying to teach something in one way.
5764690	5784810	I think that there's like a variety of different ways to teach a specific topic. And you know, a way that works for some people might not work for other people. So it's okay. And I think even preferable to have like a variety of different approaches that somebody can take to understand the material.
5784810	5812370	I'd say that's the first thing in making it accessible. And I think the second thing is to listen to the people that you're trying to communicate with as you're putting together a presentation or even just organizing your thoughts. Because I think that sort of checking in with your hopeful audience, before you start to put something together, it's just going to be huge. Because everybody's got an opinion. I mean, I guess I'm from Brooklyn, so everybody really does have an opinion.
5812370	5814130	But only ours count, though.
5814130	5832890	At least here, everybody's going to tell you exactly what they're thinking at all moments of the day or night. So it's like, you know, if you just check in with people before you go away and put something together, often, you know, they'll tell you exactly what they need. And that's why sort of community building beforehand is so important.
5832890	5855890	I think the only other thing I wanted to quickly say was, I think that, you know, for people who want to set up EFA organizations, the great thing about the EFA is that it's all over the place. So, you know, I think that one of the great things to ask yourself is, you know, how is security or privacy relevant to me in Brooklyn, in Spokane, in Baltimore, in Philadelphia, in St. Louis?
5855890	5868170	You know, how can it grow out of your local community, your city or town? And I think that will always, you know, be hugely helpful both to yourself and to the community in general.
5868830	5877650	Absolutely. I can't thank you all enough. This has been this has been excellent and unsurprisingly, I know you all well enough to know that that's what it would be.
5877650	5888450	And so I really want to thank you for the work that you're doing and remind folks that, you know, there's everyone that's on here is amazing, but also like they are amazing because they did the work. They showed up and they and they work with folks in their community.
5888610	5901730	And you can also be providing that kind of support and engaging your community and that you are the expert in the needs of your particular community from the perspective that you're able to see it and understanding, you know, that you can work with other folks that have different perspectives on your community.
5901730	5910690	And that there's a number of folks, all the folks that are here today, as well as the rest of the folks that you'll find at EFF.org slash fight that are part of Electronic Frontier Alliance associated groups.
5910690	5918270	So reach out to us email organizing at EFF.org reach out to all you'll find links on that website to all of the groups that are in the alliance.
5918270	5929690	And so there's folks here that really like inspired you and you want to be able to replicate their work, you can either reach out to organizing at EFF.org and we'll try to put you in touch, or go to the website and their links are there and you can contact them through the
5930670	5943470	avenues that are available there as well. So yeah, and thanks again, everybody DEF CON. This has been amazing. Thanks again to Curt and Eva and Alexis and Hannah and Rory, of course, and just everyone have a good night.
5943650	5952190	You know, go out and you know, whatever your whatever, however you unwind, take advantage of it and just keep continuing to love and take care of each other. All right. Thanks, everybody.