WEBVTT 01:00.110 --> 01:05.110 Welcome everybody to Ask the EFF and Meet the EFA. 01:05.110 --> 01:11.530 It is lovely to be back, sort of, at DEF CON for another year. 01:11.530 --> 01:20.830 We've been doing Ask the EFF for, I think, since DEF CON 13, taking your questions about the Electronic Frontier Foundation. 01:20.830 --> 01:25.890 Welcome everybody to Ask the EFF and Meet the EFA. 01:25.890 --> 01:29.890 It's lovely to be back, sort of. 01:29.890 --> 01:35.390 Sorry, I had two things on our channel here, so I had to deal with the echo. 01:35.390 --> 01:36.630 So, it's great to be here. 01:36.630 --> 01:39.690 We have an amazing panel for you. 01:39.990 --> 01:45.430 And we will be going down the panel so you can get an introduction. 01:45.430 --> 01:46.930 Let me introduce myself. 01:47.030 --> 01:48.370 My name is Kurt Opsahl. 01:48.370 --> 01:53.650 I am the Deputy Executive Director and General Counsel of the Electronic Frontier Foundation. 01:53.650 --> 01:56.510 And I am delighted to be back here. 01:56.510 --> 01:58.930 I work on a number of different things at EFF. 01:58.930 --> 02:03.450 One of them is the Coders' Rights Project, along with Hannah, who you'll see shortly. 02:03.730 --> 02:19.890 The Coders' Rights Project is where we provide free legal advice to security researchers like yourselves when they have questions about legality of their research, issues that may arise from disclosing it when a vendor gets upset. 02:19.890 --> 02:24.330 And these are things that we often provide to this community. 02:24.330 --> 02:29.650 But I always begin this panel with noting that this is not the time for those questions. 02:29.710 --> 02:39.270 You need to have those conversations in an attorney-client-privileged situation, which is not when it's being live-streamed to everybody at the DEF CON Twitch channel. 02:39.350 --> 02:55.230 So, we're happy to ask questions, including questions about general legal principles, but if it's about your particular situation, and that includes when you're asking for a friend, but it's really you, those are not the time to ask these sorts of questions. 02:55.550 --> 02:59.110 But feel free to ask your more general questions. 03:00.810 --> 03:06.990 And we can talk about, in addition to the Coders' Rights things, we have Hannah here, so we'll introduce yourself in a second. 03:07.250 --> 03:27.050 We also have the opportunity to talk about, well, one of the things that's come up lately that Eva and I worked on TikTok and the ban, also expanding to a ban on ByteDance and Tencent, the parent companies, a lot of interesting implications there. 03:27.470 --> 03:33.890 You can hear a bit more about our activism work through Rory. 03:33.890 --> 03:35.990 So, we've got a good show for you. 03:35.990 --> 03:37.710 Looking forward to your questions. 03:38.070 --> 03:39.990 So, why don't we start it out with Rory. 03:39.990 --> 03:40.990 You want to begin? 03:40.990 --> 03:42.590 Yeah, sure. 03:42.610 --> 03:44.050 Hey, DEF CON. 03:44.050 --> 03:44.850 I'm Rory. 03:44.850 --> 03:47.990 I'm the newest member of the EFF activism team. 03:47.990 --> 03:52.350 And I came on in March as the grassroots advocacy organizer. 03:52.350 --> 04:01.710 In that role, I work on the organizing team, which manages the EFA, which is our nationwide network of over 70 local grassroots organizations. 04:01.710 --> 04:06.910 I'm not going to spend too much time talking about that, because you're going to meet them for yourself in just a little bit. 04:07.750 --> 04:13.150 But the gist of it is, unfortunately, EFF can't be everywhere at once. 04:13.590 --> 04:21.910 And these local groups really do a lot of heavy lifting for city and state level issues, and are incredibly important for our success. 04:22.510 --> 04:32.630 And I'm lucky enough for my role to be building a lot of these relationships with local groups that are either currently members or potential members for the EFA. 04:32.630 --> 04:39.330 And I'm actually lucky enough to come to the EFF and this organizing team from an EFA group myself. 04:39.330 --> 04:44.050 I was a founding member of the CYPR collective, which you'll also meet in a little bit. 04:44.390 --> 04:49.310 So I'm really excited to have benefited so much from this network. 04:49.310 --> 04:53.510 And now I get to give back and help construct and build it further. 04:54.050 --> 05:01.510 In addition to that, part of my background, I care a lot about digital security for activists and LGBTQ plus communities. 05:01.510 --> 05:04.330 That's very much part of my CYPR background. 05:04.890 --> 05:10.710 I'm also technically still a grad student, but a former grad student and adjunct professor. 05:11.170 --> 05:20.710 So I care a great deal about student rights and teachers' rights, and concepts like open education, campus privacy, open science. 05:20.790 --> 05:33.360 And then finally, we talk a lot about EFA being in kind of three buckets, unofficially, of the workshop bucket, the advocacy bucket, and the makerspace or hackerspace bucket. 05:33.750 --> 05:38.770 And it's that last one that I really am hoping to expand on moving forward. 05:38.770 --> 05:44.970 We already have a lot of great hackerspaces in the EFA, including several DEF CON groups. 05:44.970 --> 05:49.670 Shout out to DEF CON 201, 319, 313, and 919. 05:49.670 --> 05:55.210 And then also artistic digital arts spaces like Eyebeam and NYC. 05:55.210 --> 06:04.430 So I think it's really important that we expand into this creative territory, because honestly, creativity and fun are a really important part of movement building, I think. 06:04.430 --> 06:07.510 The old, if I can't dance, it's not my revolution. 06:08.130 --> 06:27.390 And I think these issues of freedom of expression and play are one of the best ways to get people engaged in digital rights issues, because you might not think about copyright or patent or DRM or right to repair or any of these issues until it becomes a barrier between you and this really cool project you want to do. 06:27.390 --> 06:30.390 So I think it's a really important part I'm hoping to expand. 06:30.390 --> 06:35.410 So I think there's a lot of folks in the audience that are involved in those sort of projects. 06:35.450 --> 06:36.370 I'll plug now. 06:36.370 --> 06:40.730 Reach out to me at Rory at EFF.org or organizing at EFF.org. 06:44.070 --> 06:46.150 And then I guess we go to Hannah. 06:49.950 --> 06:51.450 Hi, I am Hannah. 06:51.450 --> 06:54.270 I am a staff attorney at EFF. 06:54.270 --> 06:59.070 I'm super excited to be virtually part of DEF CON. 06:59.230 --> 07:03.170 I'm really looking forward to the day when we can attend in person. 07:03.530 --> 07:07.590 But I, like Rory, I started very recently. 07:07.590 --> 07:08.950 I only started in April. 07:08.950 --> 07:13.910 It's kind of an unprecedented time and a very unique time to be starting work at EFF. 07:13.910 --> 07:22.130 There are a lot of issues that have come up in relation to the things that have been going around in the world in 2020. 07:22.130 --> 07:38.450 COVID, of course, being one of the large ones, but also the protests that have risen up around the country and indeed around the entire globe for justice, racial justice against police brutality and related topics. 07:38.690 --> 07:42.070 My background is actually in criminal justice. 07:42.070 --> 07:50.490 So I come from having practiced in criminal defense law for a number of years before joining EFF. 07:50.490 --> 07:56.490 So as Kurt mentioned, I am part of the Coders' Rights Project. 07:56.490 --> 08:01.030 And he already gave a really good explanation of that, so I won't go into it. 08:01.030 --> 08:05.850 But needless to say that it is an important part of our work. 08:05.850 --> 08:28.470 I, as someone who very long time ago in a different lifetime for undergrad had a computer science degree, really appreciate the kind of work that we can do for independent security researchers, hackers, tinkerers, anyone who's interested in poking around in systems and the like. 08:28.470 --> 08:49.310 And recently at EFF, I guess my most recent cases, I've also worked a lot on police tech and forensic technology because law enforcement and prosecutors use a lot of different types of technology, from things like automatic license plate readers and facial recognition, 08:49.310 --> 09:01.630 which we hear a lot about, to things that we hear slightly less about, like forensic probabilistic software, which is supposed to do DNA analysis and match DNA of people. 09:01.630 --> 09:09.050 And, you know, you hear these giant numbers like one in three trillion or something like that, where people are matched. 09:09.050 --> 09:11.910 And actually there's a lot of issues with these technology. 09:11.910 --> 09:23.670 And what we have seen before is that law enforcement, that these kinds of technology tend to be used against marginalized groups and against the most vulnerable communities. 09:23.670 --> 09:31.670 So we really should make sure that they're constitutional, that they're accurate, that they're not biased. 09:31.670 --> 09:34.830 And if they are, they should not be used at all. 09:34.830 --> 09:42.050 So I look forward to engaging with the DEF CON community and to listening to all your questions. 09:42.330 --> 09:43.250 Thank you. 09:43.250 --> 09:43.930 Eva? 09:46.560 --> 09:47.560 Hi there. 09:47.560 --> 09:48.480 I'm Eva Galperin. 09:48.480 --> 09:51.840 I'm the director of cybersecurity at the Electronic Frontier Foundation. 09:51.840 --> 09:55.860 This is extremely not my first DEF CON. 09:55.900 --> 10:01.000 I have been coming to DEF CON since somewhere around the year 2000. 10:01.220 --> 10:03.900 Dinosaurs were roaming DEF CON. 10:04.260 --> 10:09.360 And it was sort of in this setting that I discovered EFF. 10:09.360 --> 10:13.940 Little, you know, sort of clueless teenage me went, hey, these guys seem to be the good guys. 10:13.940 --> 10:15.220 I should do that one day. 10:15.220 --> 10:16.220 And then I did. 10:16.220 --> 10:20.360 So I've been at EFF since 2007. 10:20.360 --> 10:26.080 And I have done, I don't even know how many of these Ask EFF panels. 10:26.120 --> 10:40.640 But right now what I do is I run the EFF Threat Lab, which is a group of researchers who work specifically on issues that affect particularly vulnerable populations. 10:40.640 --> 10:53.820 So people who are protesting, people in LGBTQ populations, people who have unpopular political opinions, people who are part of ethnic minorities. 10:54.320 --> 10:56.920 We're interested in having their backs. 10:56.920 --> 11:04.580 And I don't know if you have been watching some of these DEF CON talks at the virtual event. 11:04.580 --> 11:16.800 But my colleague, Cooper Quinton, gave a talk on his project, Crocodile Hunter, which had to do with tracking fake base stations. 11:16.800 --> 11:18.380 And I strongly recommend that. 11:18.380 --> 11:22.000 It's based on the work that he did with our colleague, Yamna. 11:22.280 --> 11:24.260 So I can answer questions about that. 11:24.260 --> 11:31.080 And also I can answer questions about TikTok and about general sort of privacy and security advice. 11:31.080 --> 11:39.400 And how to reach out to people in a way that moves them to action, but does not scare their pants off. 11:42.730 --> 11:43.490 All right. 11:43.490 --> 11:45.090 Well, thank you for that. 11:45.370 --> 11:47.590 So that is the introduction to our panel. 11:47.630 --> 11:47.890 Oh , wait. 11:47.890 --> 11:53.090 Alexis is a little bit late, but still lovely to have you here. 11:53.090 --> 11:54.870 Alexis, you want to give an intro, please? 11:55.710 --> 11:56.550 Hi. 11:56.570 --> 11:58.250 Sorry for being late. 11:58.470 --> 11:59.550 I'm Alexis Hancock. 11:59.550 --> 12:03.030 I'm a staff technologist at the EFF. 12:03.030 --> 12:07.730 And I've been around working at EFF about two years now. 12:07.730 --> 12:10.550 So coming on my two-year anniversary, actually. 12:10.550 --> 12:12.350 Just now realized that. 12:12.450 --> 12:16.550 I work on the project HTTPS Everywhere. 12:16.770 --> 12:18.850 And mainly that's my main focus. 12:18.850 --> 12:27.210 But I also do research on other aspects of consumer privacy and how it impacts different populations. 12:27.230 --> 12:28.870 So that's been my focus. 12:28.870 --> 12:35.910 And as of late, especially with COVID immunity passports, which mentioned verified credential technology. 12:35.910 --> 12:41.070 So dealing with mobile identities research and how that may impact the general public. 12:42.510 --> 12:44.550 And that's my intro. 12:46.590 --> 12:47.450 All right. 12:47.450 --> 12:48.870 Well, thank you, Alexis. 12:48.970 --> 12:50.250 So that is our panel. 12:50.250 --> 12:53.010 We are now going to turn to your question. 12:53.010 --> 12:55.870 We've had a few questions come in. 12:55.890 --> 13:04.530 So one question is, what is the strongest and most readily understood argument to support protection of end-to-end encryption? 13:04.530 --> 13:15.290 We're talking with organizations, particularly non-technical audience, working to address controversial complex topics such as the transmission of child sex abuse materials. 13:16.470 --> 13:19.250 So Rory, did you want to have something to say on that? 13:19.450 --> 13:20.310 Yeah, definitely. 13:20.310 --> 13:27.770 So this is something that I think comes up a lot when you're engaging different communities on things like end-to-end encryption or even just the concept of hacking. 13:27.770 --> 13:32.230 People have this very NCIS kind of concept of what that means. 13:32.230 --> 13:35.850 That you must be like this shady character. 13:36.010 --> 13:44.450 But what I usually like to pivot to is say, it's less about being shady and being on the margins, more about being on the margins. 13:45.010 --> 13:47.490 That end-to-end encryption is really important. 13:47.490 --> 13:53.930 Yes, sometimes for people with nefarious purposes, but also people with very good just purposes. 13:55.410 --> 14:01.210 The power of breaking end-to-end encryption or banning it is one that you have to consider. 14:01.590 --> 14:03.770 Is that a power you want? 14:03.950 --> 14:10.430 You might be comfortable with the US president having, but are you okay with another foreign leader having? 14:10.730 --> 14:13.410 Current leader, future leaders? 14:13.630 --> 14:19.850 And thinking about who is on the margin and who are we protecting with this technology? 14:19.850 --> 14:22.810 And ultimately, everyone has the right to have that protection, right? 14:22.810 --> 14:28.550 It's part of being able to speak freely and live in a free society to have some privacy. 14:28.770 --> 14:39.090 So I think that's usually a good hook for folks that are kind of just honestly perplexed by why anyone would support end-to-end encryption. 14:40.590 --> 14:41.730 Thanks, Rory. 14:41.750 --> 14:54.250 To add a little something from my experience, I've been to a number of events or conferences where people from the organizations that are trying to stop childhood sexual abuse were present. 14:54.250 --> 14:55.850 We talked about end-to-end encryption. 14:55.930 --> 15:00.770 And I'd say that they actually were understanding about the human rights concerns. 15:00.770 --> 15:03.290 They have their very strong position. 15:03.290 --> 15:11.150 They want to be able to do whatever they can to stop child sexual abuse materials. 15:11.630 --> 15:29.850 But I would say in terms of just talking about it, they were a lot more understanding that there were countervailing human rights concerns about breaking encryption than the government people who are at the very same conferences who are often using or pointing to those groups in order to support their arguments. 15:30.270 --> 15:45.730 And I think they probably, you know, we're not going to agree on the ultimate path for encryption, but I think that they would say if there's a way to have, you know, great, strong encryption, you know, that is fine, so long as their needs are addressed. 15:45.790 --> 15:48.370 But we can have the conversation, at least. 15:49.550 --> 15:53.110 All right, we'll get to another one of your questions. 15:53.960 --> 16:03.330 What would you say would be the difference between Congress interviewing Mark Zuckerberg in 2018 and Congress interviewing the tech giants a few weeks ago? 16:04.350 --> 16:06.910 Anyone been following that? 16:06.910 --> 16:09.290 We don't have our alleged team on. 16:09.290 --> 16:15.310 I did watch the antitrust hearing that came up recently. 16:15.310 --> 16:31.730 I won't be able to speak historically to what our alleged team thought of the previous hearing, but from what I did, some eyes from my colleagues that watched both, Zuckerberg generally seems more prepared for these questions from Congress. 16:32.510 --> 16:50.770 Then normally, then the other CEOs that came through with the original intention of what the hearings are about are trying to see, like, exactly where are the PowerPoints that you can focus in on with these organizations and where exactly are they overstepping. 16:50.770 --> 17:06.090 And the differences between the last one and this one, from what I surmised, was that they were just coming to terms with privacy issues and how the general public are worried about them with Zuckerberg and Facebook, Cambridge Analytica. 17:06.530 --> 17:19.170 All those different types of like themes came up with his hearing in particular, and he seemed more strained then, and then this time around he seemed way more prepared than the other CEOs. 17:19.170 --> 17:28.650 So the other CEOs had came and asked about this and we also want to call to the other previous antitrust hearing that Bill Gates attended two years back. 17:28.930 --> 17:42.510 That the legislation team also mentioned, where that was kind of like the beginning of Congress's thought patterns on how to regulate and what to do when it comes to tech companies gaining such a mass amount of market power. 17:42.510 --> 17:56.050 So I do suggest looking back at that hearing as well and seeing what people's opinions were on that, because that was kind of where it started, I believe, with Congress's thought patterns on what to do and what to ask when it comes to tech. 17:56.050 --> 18:19.750 Mark Zuckerberg's hearing was very much so rife with people who didn't quite understand how the tech, and were asking questions that didn't necessarily get to the meat of the issue on why exactly Facebook has been nefarious, and why exactly Facebook's practices are a problem versus understanding other things. 18:19.750 --> 18:31.850 That came up again at this recent antitrust hearing where a couple Congress members, or at least one I remember in particular, who didn't quite understand how spam email worked and kind of tried to like blame Google for that. 18:31.850 --> 18:38.030 So that was pretty much what I saw from the recent hearings from Facebook's side. 18:38.030 --> 18:42.430 Apple was mainly quiet around the issues that we wanted them to talk about. 18:42.430 --> 18:49.290 But overall, I did like the round of questioning that did happen from some of the representatives on the Judicial Committee. 18:49.290 --> 19:00.870 And they tried their best to grill them on the things that did matter at times, but then it's a balance between the different parties and what their intentions were. 19:01.010 --> 19:07.150 It seemed like the Republican Party was more focused this time around on censorship, and that's not antitrust. 19:07.150 --> 19:14.290 So it went from good antitrust question to really bad sidetracked censorship question. 19:14.290 --> 19:25.050 So not focusing on antitrust was a real big, I think, pain point for a lot of people watching who really wanted them to focus on the antitrust portions of the questions. 19:25.150 --> 19:32.420 And that's my peripheral, you know, summation as a non-legislative person from EFF. 19:33.580 --> 19:34.460 All right. 19:34.460 --> 19:35.380 Yeah, thank you. 19:35.380 --> 19:42.740 And go to our website to get more information because we have blog posts covering both those sets of hearings. 19:43.060 --> 19:45.280 So another question came in. 19:45.660 --> 19:52.560 Does EFF, as a U.S.-based organization, how does EFF, as a U.S.-based organization, see its role internationally? 19:52.560 --> 19:54.540 I think Eva got this one. 19:54.540 --> 19:56.560 All right, I can cover this one. 19:56.560 --> 20:01.980 I worked as part of EFF's international team for many years. 20:02.220 --> 20:07.040 And EFF started out as an American-based organization. 20:07.040 --> 20:13.980 And this was largely because we saw ourselves as a group of people who primarily did impact litigation. 20:13.980 --> 20:17.500 And so we had a bunch of U.S.-based lawyers because the U.S. 20:17.500 --> 20:26.580 is where most of the laws that were impacting the Internet or impacting the cutting edge of technology were being made and where the court cases were happening. 20:26.720 --> 20:33.080 And we are not entirely about impact litigation anymore. 20:33.080 --> 20:37.960 And those cases aren't necessarily happening in the United States. 20:37.960 --> 20:48.480 You're starting to see them in European courts, in Brazilian courts, in Russian and Mexican courts. 20:48.480 --> 20:51.960 The U.S. 20:51.960 --> 20:56.400 president apparently would like our Internet to look more like China's. 20:56.400 --> 21:06.300 And that is a fairly serious problem that requires an international approach in order to fix. 21:06.300 --> 21:09.720 So having said that, what we did was we built an international team. 21:09.720 --> 21:18.820 We have people who do international law, who understand international human rights, who speak to the UN. 21:19.380 --> 21:21.920 We have people who are not based in the United States. 21:21.920 --> 21:28.580 We have people who go and talk to The Hague and to Brussels. 21:28.580 --> 21:49.800 And also people who understand that the Internet isn't just the developed world, that the world is not divided up into the West and the rest, and that the rules which govern the Internet need to be fair, not just to Americans and to Europeans, but also to people in the Global South, 21:49.800 --> 21:53.340 and that their voices really matter when it comes to this conversation. 21:53.340 --> 22:08.900 And often they're the people who get left behind when we talk about privacy and security, because they're the people who are using some of the slowest infrastructure, and they're often the people who are using the cheapest products in order to get online or to communicate. 22:08.900 --> 22:19.640 And often if you did not pay extra, then you are the product and you're essentially selling either your privacy or your security. 22:19.640 --> 22:21.780 We find that very alarming. 22:21.780 --> 22:33.200 We also built a set of privacy and security guides, and we have those translated into eight different languages. 22:33.200 --> 22:37.660 We update them regularly, which almost no other security guide does. 22:37.660 --> 22:46.940 Everything has a date on it that tells you when, you know, this advice is good as of this date, and we translate it into languages. 22:46.940 --> 22:52.020 So the Internet, in addition to being global, is not just English-speaking. 22:54.020 --> 22:55.260 Thank you. 22:55.260 --> 23:05.960 Another question was, any advice for loosely federated national organizations working to simultaneously prevent doxing while preserving accountability, i.e. 23:05.960 --> 23:14.260 doing IAM for an organization where the national may not know or want to know all of the local's members? 23:15.820 --> 23:17.660 Yeah, I could take that one. 23:17.860 --> 23:20.440 So it's a really interesting question. 23:20.440 --> 23:38.420 I'd want to know a lot more of the specifics before giving any kind of concrete advice, but I will say loosely federated national organization makes my ears ring a little because the EFA is a national organization of a network of people coordinating efforts. 23:38.420 --> 23:40.560 So I think there's probably a lot of overlap. 23:40.560 --> 23:45.880 If you went to EFF.org slash fight, we have some really useful toolkits. 23:46.080 --> 23:58.420 So I think some sample suggestions would be establishing basic principles on the onset and maybe writing up like a simple mission letter and having those groups sign on to it. 23:58.420 --> 24:16.540 I think where it probably diverges a bit is if you don't necessarily want to know the individual federated instances, particularly closely, that on our end, it's really important to build those kind of intimate relationships with our members and find these kind of intersections. 24:16.540 --> 24:25.220 So maybe finding another way of communication among maybe more anonymized communication among the members of the Federation. 24:25.440 --> 24:26.940 So those are some things that come to mind. 24:26.940 --> 24:28.660 Definitely check out the toolkits. 24:28.940 --> 24:33.900 It's not exactly the same as coalition building, but I definitely see some overlap there. 24:38.000 --> 24:38.580 Wonderful. 24:38.580 --> 24:39.420 Thank you, Goree. 24:39.420 --> 24:45.100 So the next question is from DC201. 24:45.980 --> 24:58.580 We are live streaming on the Crypto Barons right now and did a review of the article about California using blockchain to track people's COVID-19 status under a social credit system and a secure record. 24:58.660 --> 25:00.820 I want to hear straight from you guys your take. 25:00.820 --> 25:02.280 Keep up the good fight. 25:02.680 --> 25:04.780 Alexis, you've been working on immunity passport issue. 25:04.780 --> 25:06.260 What do you have to think about this? 25:07.680 --> 25:11.620 Yeah, so actually the immunity passport work came directly from this bill. 25:11.620 --> 25:15.580 The bill in reference is AB2004. 25:15.580 --> 25:20.920 And that's been in play for a while and the EFF opposes it for several reasons. 25:20.920 --> 25:29.860 One of it is the fact that it's using a techno solution based practice towards a very, very loose dynamic situation. 25:30.640 --> 25:49.880 Verify credentials, which is the technology mentioned in the bill, is for more static purposes and also immunity passports isn't something that is actually normalized for the general public to enter buildings, to enter their job, to enter venues or public spaces. 25:49.880 --> 25:55.820 This is not a practice that's been in play and the history in the United States with immunoprivilege isn't a good one. 25:55.820 --> 26:13.220 So if you go back and look at the yellow fever in that position, you'll see that the United States has a very bad track record of handling immunoprivilege when you have a certain amount of population who can't exactly get testing at equal rates as other people in the population. 26:13.220 --> 26:16.700 So not being able to update your status as much. 26:16.700 --> 26:21.040 We don't know, according to health experts, exactly how COVID works still. 26:21.040 --> 26:22.860 People are getting reinfected. 26:22.860 --> 26:27.100 There's other people out there with COVID who may be asymptomatic. 26:27.100 --> 26:31.320 And we don't know how the antibody testing will be handled in the future. 26:31.320 --> 26:48.120 So rolling this out as a techno solution, using blockchain for the verified registry and a verified credential isn't necessarily something that calls to arms where you're building up something with a technology that claims it's going to be very secure and very straightforward, 26:48.120 --> 26:50.780 but at the same time, this is not a straightforward time. 26:50.780 --> 26:54.960 COVID and immunity isn't a straightforward practice at the moment. 26:54.960 --> 27:05.020 So trying to build up something and say just because we're using encryption and just because we're using a secure tool doesn't necessarily mean the tool itself is good or the credential itself is good. 27:05.020 --> 27:23.360 Basing people's immunity into a shared health credential with law enforcement or their employer puts people in very precarious positioning in our general public and that can exacerbate already the inequities that we have seen exacerbated during this pandemic. 27:23.360 --> 27:39.120 And this would just add to the pile of inequities we have seen by making something like this the standard when we don't have, we don't even have a plan on like how we're going to handle sending kids to school. 27:39.120 --> 27:44.060 So like being able to roll out something as COVID immunity passports, we're using blockchain. 27:44.060 --> 27:54.700 It's a very techno solution, Silicon Valley approach to something that we cannot just roll out something or an app or a technology and say we saw the pandemic, everybody go out and have a good time. 27:54.700 --> 27:56.180 That's not how this works. 27:56.180 --> 28:05.620 So that's our take generally on it and we oppose this bill still and you will see more recent blog posts if you go on to the site and going over that again. 28:05.620 --> 28:08.720 We've written several times on this and hopefully they listen. 28:08.880 --> 28:11.800 And generally, I just want this bill to die. 28:11.800 --> 28:22.980 And I don't want to see anything go through with this because I just don't think immunity passports or verified credentials or using blockchain for a verified registry is the solution to this. 28:22.980 --> 28:31.280 We're going to need a multifaceted policy-based approach to this pandemic and we can't leave it up to, oh, we use blockchain, everything's fine. 28:37.280 --> 28:38.360 Thank you. 28:38.360 --> 28:46.440 And the next question is, what type of rhetoric do you think the forced selling and restriction of TikTok and other Chinese apps will set? 28:46.600 --> 28:51.440 Will network sovereignty be a philosophy we will have to fight in the near future? 28:51.440 --> 28:58.660 So as it happens actually right before this, Eva and I were working on an op-ed to talk about the TikTok ban. 28:58.660 --> 29:13.840 And we've been actually looking very closely on the ban on TikTok and also on Tencent, the makers of WeChat, and also things like League of Legends and a 40% owner of the owners of Fortnite. 29:14.520 --> 29:17.120 So this is a very, very hot issue here. 29:17.120 --> 29:25.880 And I think as far as from a legal and constitutional perspective, this ban is extremely troubling. 29:25.900 --> 29:43.100 The sanction authority that the president has invoked here has an exception for communications, including a implicit prohibition of communications, and a ban that would stop people from using TikTok would be exactly that. 29:43.100 --> 29:44.980 It seems to be outside the statute. 29:44.980 --> 30:02.660 But perhaps more importantly, on a constitutional level, it is banning a means of expression that the power to say, you know, unilaterally with an executive order that the president could say, you can't use this particular communication channels anymore, 30:02.660 --> 30:09.400 you can't speak to the audience through that channel, has tremendous implications for free expression. 30:09.400 --> 30:12.620 And it goes beyond what should be tolerated. 30:12.620 --> 30:21.580 Now, I understand like a lot of people also are concerned about, well, D, you know, but TikTok, they're gathering a lot of data, they've had some privacy scandals. 30:21.640 --> 30:26.680 But I'll turn to Eva to talk a little bit more about the privacy and security concerns. 30:29.050 --> 30:33.430 So I'm not going to get up in front of everybody and tell you TikTok is totally safe. 30:33.430 --> 30:50.430 I will tell you that for the most part, it uses the same permissions and has many of the same security and privacy vulnerabilities that you see with similar social media apps. 30:50.430 --> 31:00.350 The only difference is that TikTok is located in China, they are owned by a Chinese company, they have employees in China. 31:00.350 --> 31:04.790 They say they do not keep any US data in China. 31:05.070 --> 31:09.730 But the real question is, how much do you trust TikTok? 31:09.730 --> 31:18.330 Is this what TikTok would say even if they were keeping US data in China, even if they were handing over all of the US data directly to the Chinese government? 31:18.570 --> 31:22.510 And I, for one, don't trust the Chinese government very much. 31:23.350 --> 31:35.150 Having said that, we are deeply opposed to the idea that the president should be able to ban an app via executive order. 31:36.150 --> 31:38.990 There are a whole lot of legal problems with that. 31:39.130 --> 31:46.730 And it really sort of eclipses any kind of real conversation that we should be having about data sovereignty. 31:46.910 --> 32:06.690 Because after the Snowden allegations, one of the very first things that happened was the European countries started working on eventually becoming a GDPR and talking about data sovereignty in a much more serious way because they felt that they couldn't trust US companies to not hand over data to the NSA. 32:06.850 --> 32:08.630 And they're right. 32:08.830 --> 32:19.810 And we should not be hypocrites who think that it's not okay for companies to hand data over to governments, unless it's ours, in which case it's totally fine. 32:20.150 --> 32:23.470 You know, we have rule of law and human rights and stuff. 32:24.230 --> 32:28.790 My willingness to believe in our rule of law and human rights is increasingly strained. 32:30.130 --> 32:33.810 So I think, yes, we are going to be talking about data sovereignty. 32:33.810 --> 32:55.930 And one of the biggest problems we're going to have is that we are going to find ourselves battling xenophobes, people who are appealing to nationalism and to sort of anti-Chinese hatred as a way of knocking out the competition or lashing out at people who are not like them. 32:55.930 --> 33:01.350 There are real concerns about TikTok, but these are not the concerns in question. 33:01.350 --> 33:08.410 The people who should be really concerned about TikTok are the people who are worried about having their data fall into the hands of the Chinese government. 33:08.410 --> 33:32.470 So if you are a Uyghur, if you are a protester in Hong Kong, if you're friends with a protester in Hong Kong, if you're a journalist who wants to protect your sources, and you have sources that are of interest to the Chinese government, if you're a COVID-19 researcher or a Fortune 500 executive who is worried about having the IP for your company stolen, 33:32.470 --> 33:36.370 then, yeah, you should really be concerned about TikTok. 33:36.370 --> 33:41.530 But a full ban is absolutely not the answer. 33:44.070 --> 33:45.150 All right, thank you. 33:45.150 --> 33:52.570 And just to add on to that, one of the aspects of this is it's balkanizing the Internet. 33:52.570 --> 33:57.050 It's sort of the notion of that there will be apps per country. 33:57.570 --> 34:02.450 And this is something that is very concerning. 34:02.450 --> 34:05.950 One of the benefits of the Internet is that it is a worldwide forum. 34:05.950 --> 34:11.450 I can see people's real concerns about the privacy and security of data in other countries. 34:11.450 --> 34:18.030 And whether it is, as he was saying, the European Union was concerned about data in the United States. 34:18.030 --> 34:20.850 Brazil has been concerned about data in the United States. 34:20.850 --> 34:26.870 Of course, sometimes, I think like in the case of Brazil, it's not because they want to protect that data from themselves. 34:26.870 --> 34:31.970 They actually want the data locally, so they can be the ones spying on it instead of the NSA. 34:32.470 --> 34:38.010 And I think the better solution to all of this is to just worldwide have protections against massive spying. 34:38.010 --> 34:39.110 Now, that is a hard job. 34:39.110 --> 34:41.750 It will take policy, it will take law, it will take technology. 34:42.290 --> 34:50.370 But the ultimate goal, I think, is to have a worldwide Internet that also has safeguards to protect privacy. 34:50.370 --> 35:04.230 All right, we'll get on to the next question, which is, what is EFF's position on spyware, such as ProctorU, currently being forced on students for exams in some North American universities? 35:05.290 --> 35:07.850 Hannah, did you want to introduce that topic? 35:07.850 --> 35:08.850 Sure. 35:09.310 --> 35:16.630 Of course, and I know others will have stuff to say about ProctorU and other types of software like ExamSoft as well. 35:16.630 --> 35:22.150 But of course, what ProctorU and ExamSoft and all these types of software do is very concerning. 35:22.150 --> 35:27.850 Student privacy is incredibly important, especially since students... 35:28.630 --> 35:37.030 The example I believe the questioner gave is at universities, in which case most of them are likely to be over the age of 18. 35:37.030 --> 35:44.770 But we know that some of these are also used in classrooms where the majority of the students are under the age of 18. 35:44.770 --> 35:58.810 And that carries a lot of implications for their rights and what consent really even means in those situations when they're consenting to having their privacy invaded or to installing these apps and using them. 35:58.810 --> 36:12.750 It's also important to remember that these, just these programs, nefarious as they are, are not the first instances of how student privacy has been invaded. 36:12.750 --> 36:25.870 We know that students use a lot of school-owned and school-issued devices, and we really encourage robust protection for their privacy for their uses of even school-owned devices. 36:25.870 --> 36:39.650 This is just another example, I think, of invading the privacy of students, the ever-increasing encroachment into their private lives by having these software. 36:39.650 --> 36:55.850 And of course, some of these so-called software's functionalities are really the type of Trojan horses and spyware that we really rail against when they are from other companies and not ExamSoft. 36:55.870 --> 36:56.890 And so, 37:00.180 --> 37:29.100 again, this is just another example of how students use a lot of school-owned and school-issued devices, and we really encourage robust protection for their privacy. 37:29.100 --> 38:00.190 And so, again, this is just another example of how students use a lot of school-owned and school-issued devices, and we really encourage robust protection for their privacy. 38:00.650 --> 38:10.750 Yeah, and I just wanted to quickly plug, we have a blog post recently about this on our website called University App Mandates are the Wrong Call, written by some of our colleagues. 38:11.010 --> 38:14.530 And it brings up some really important points I want to echo here. 38:15.210 --> 38:26.030 One of the main things is these mandates, not just for crock-tarring apps, but for contact tracing and things like that, make a lot of assumptions about students that are problematic. 38:26.030 --> 38:31.750 For example, assuming their devices, a lot of these only work on Windows and macOS. 38:31.850 --> 38:41.350 Plenty of Linux users or even Chromebook users have complained about not being able to take their class because of those restrictions. 38:41.350 --> 38:44.810 There's also plenty of concerns about accessibility. 38:44.970 --> 38:49.870 For example, when students have screen-reading software, it can become an issue to use these tools. 38:50.610 --> 38:58.690 And then just the broader issue of having reliable broadband and schools not offering an alternative to these online crock-tarring solutions. 38:59.030 --> 39:04.830 And then more broadly, it goes against all the stuff of open education that we know and love. 39:04.830 --> 39:08.370 Education should be easy and not infringe on your other rights. 39:08.370 --> 39:17.490 To quote the blog real quick, universities should strike down any app mandates and should pledge to not include them in future student commitments. 39:17.810 --> 39:22.690 It's something that a lot of EFA student groups have reached out about so far. 39:22.690 --> 39:25.550 So I really encourage you to also reach out. 39:25.550 --> 39:28.370 It's something I'm very interested in pursuing. 39:31.290 --> 39:32.290 Great. 39:32.290 --> 39:36.750 So another question we had was about... it's also on the international front. 39:36.750 --> 39:41.950 It was about whether there's an EFF affiliate in Canada. 39:42.090 --> 39:44.330 And so we're actually going to give you some background. 39:44.330 --> 39:51.190 Once upon a time in the mists of past, there were international electronic frontiers affiliates. 39:51.190 --> 39:57.770 And in the 90s, the early years of EFF, we moved away from having an affiliate model. 39:57.770 --> 40:02.310 But we didn't kick people out, tell them to stop using the name. 40:02.310 --> 40:05.810 So there actually are a couple of electronic frontiers affiliates left. 40:05.810 --> 40:11.410 There's electronic frontiers Finland, I think is probably the most active chapter. 40:11.410 --> 40:18.470 There's also an electronic frontiers Australia, and I believe Italy is still somewhat around. 40:18.470 --> 40:25.110 But we do not have an actual affiliate in Canada. 40:25.110 --> 40:29.650 But there are a number of organizations in Canada that we have worked in. 40:29.650 --> 40:32.230 I think Eva, you've worked a lot with some. 40:34.270 --> 40:35.910 Citizen Lab, were you able? 40:35.910 --> 40:36.390 Yes. 40:36.390 --> 40:41.790 So the two that I was about to suggest are CIPIC and Citizen Lab. 40:41.790 --> 40:47.330 Citizen Lab is based out of Toronto, and they're all academics and security researchers. 40:47.330 --> 40:48.090 Highly recommend. 40:48.090 --> 40:49.350 We put out some research with them. 40:49.350 --> 40:50.250 They're great. 40:50.730 --> 41:01.510 And CIPIC mostly does law and policy, which is good because the law and policy in Canada matters just as much as it does in the United States. 41:01.510 --> 41:04.310 This is really important to us. 41:09.380 --> 41:10.260 Very good. 41:10.260 --> 41:12.300 So another question we have in here. 41:12.300 --> 41:16.960 How does the US approach to privacy legislation impact your work? 41:17.280 --> 41:24.080 I mean, sometimes it is the work, but is there any hope that it may be changing in the next five to 10 years? 41:24.080 --> 41:28.320 Is there realistic hope for any more GDPR style approach in the US? 41:29.180 --> 41:32.020 Hannah, do you want to talk about eCPA and CALECPA? 41:32.020 --> 41:33.640 Sure. 41:33.900 --> 41:47.880 So I don't know if there is any realistic hope for a GDPR style federal legislation, given the type of gridlock that we see currently in DC. 41:47.880 --> 41:55.920 It doesn't seem like that kind of tension that prevents something like GDPR being passed will really dissolve anytime soon. 41:55.920 --> 41:59.780 But what we know is that it is effective on a state to state level. 41:59.780 --> 42:04.740 So we do have the federal eCPA, which is Electronic Communications Privacy Act. 42:04.740 --> 42:10.340 And it's supposed to protect electronic communications and the stuff that you send. 42:10.340 --> 42:19.920 It is not nearly as protective as, for example, CALECPA, which is the California version of the bill. 42:19.920 --> 42:26.600 And now the California law, CALECPA, is much more protective because it also provides a remedy. 42:26.600 --> 42:42.700 That is a right for the person whose information has been wrongly collected in violation of this law to challenge it and have that information suppressed, deleted, which is not something that the federal law offers. 42:42.700 --> 42:48.760 A thing that we always joke in lawyer circles is you will have all these laws that have rights. 42:48.760 --> 42:52.360 But when they are violated, the laws don't tell you what you get to do. 42:52.360 --> 42:53.280 You don't get money. 42:53.280 --> 43:00.760 So, for example, if you were wrongly convicted, you don't get any money from the state for the years that you spent in prison. 43:00.760 --> 43:07.700 So you can have all these rights, but that doesn't mean that those rights come with ways to enforce them and to effectuate them. 43:07.700 --> 43:13.760 And that's why something like CALECPA is such a monumental law. 43:13.760 --> 43:22.360 First of all, California being the largest or most populous state in the U.S., it affects a large number of people. 43:22.360 --> 43:27.180 Second, obviously, the tech industry is centered in California. 43:27.180 --> 43:33.580 And third, because it is the most protective law in the United States of its kind. 43:33.580 --> 43:51.020 It requires that the government, any branch of government, so not just law enforcement, but any government entity, to have to comply with certain regulations in order to collect electronic data. 43:51.020 --> 44:02.400 They can't just, you know, pass a law that says, okay, from now on, we can collect, you know, for example, schools can collect all this information about students. 44:02.400 --> 44:05.080 There was some discussion on that. 44:05.080 --> 44:13.840 And we actually have a case right now regarding CALECPA because the city of L.A. 44:13.840 --> 44:26.360 passed a law where it required all the scooter rental companies to provide real-time and historical movement data of every single one of their scooters. 44:26.360 --> 44:30.160 And we are challenging it as a violation of CALECPA. 44:30.160 --> 44:35.740 So it really demonstrates that privacy legislation can work on a state-to-state level. 44:35.740 --> 44:43.500 So it's still very important to vote for your state representatives, your state assembly people, and your state senators. 44:43.740 --> 44:46.760 And even if the D.C. 44:46.760 --> 44:50.440 will never see, or it is unlikely that D.C. 44:50.440 --> 44:58.440 will ever see a GDPR-style law in the near future or foreseeable future, it's still something that you can get passed on the state level. 44:58.440 --> 45:08.480 Especially one where there may be state legislators who are interested in protecting this kind of thing. 45:10.220 --> 45:11.100 All right. 45:11.100 --> 45:17.000 I'll just add a little bit on the CCPA, the California Consumer Privacy Act. 45:17.000 --> 45:21.860 So what Hannah was talking about with ECPA is privacy mostly vis-a-vis the government. 45:21.860 --> 45:35.040 But there also has been a consumer privacy law passed in California, which provides certain rights that are like GDPR. 45:35.040 --> 45:39.060 It has a number of exceptions for smaller businesses. 45:39.280 --> 45:43.720 It is probably not considered to be as strong as the GDPR. 45:43.720 --> 45:46.200 It's not nationwide, of course, just in California. 45:46.200 --> 45:53.060 On the other hand, a lot of the tech companies are in California, meaning that it does have a big effect on that industry. 45:53.500 --> 46:05.720 Now, what's going on there is that the law went into effect at the beginning of this year, but there's also a proposition on the ballot in California that would replace the CCPA. 46:05.840 --> 46:14.340 So I guess we will find out in November whether the CCPA will continue or will be replaced with something else. 46:15.340 --> 46:23.720 And I totally agree that the GDPR-style thing at the federal level seems unlikely, at least for now. 46:23.720 --> 46:42.040 Though one effect of the state-by-state process is if, as often happens, different states come up with different rules, that puts additional pressure on the companies to abide by the various rules. 46:42.040 --> 46:47.300 And they become perhaps more receptive to having a national standard. 46:47.300 --> 47:01.380 On the other hand, they will also, especially if they're like data brokers and such, will want to lobby to make sure that those national standards are a ceiling, while the privacy advocates would like to have the national standards be a floor. 47:01.380 --> 47:15.200 That could become all the more important to be involved, which I think actually you can be involved through the EFA. 47:15.200 --> 47:16.020 Rory? 47:18.290 --> 47:23.770 Yeah, if you're interested in being involved, please reach out to organizing at EFF.org. 47:23.770 --> 47:26.930 We're always excited to have more organizations join the network. 47:26.930 --> 47:38.910 But also, if you're not directly related, if your group's a little tangential, but would like to be put in touch with another EFA group that is in the organization, you can see a list of them at, again, EFF.org. 47:39.870 --> 47:45.350 Or email us and we'll put you in touch with some local advocates and get you involved. 47:45.470 --> 47:49.470 Again, base building, the more people on our side, the better. 47:49.590 --> 47:55.830 And especially for local issues, the EFF is only so many people with so many resources. 47:56.230 --> 48:00.510 EFA groups really help us address these really local issues as well. 48:01.870 --> 48:05.790 And so there's lots of actually ways that you can get involved with EFF. 48:05.790 --> 48:08.470 So there's the EFA route, you'll get to meet the EFA. 48:08.750 --> 48:10.790 And we'll start that in about 10 minutes. 48:11.050 --> 48:14.010 There's also the Action Center, act.eff.org. 48:14.010 --> 48:19.370 You can go there and we'll try to help you get your voice heard. 48:21.610 --> 48:29.270 And you can also get involved, a lot of you in this audience are probably coders, and you can get involved directly with our open source projects. 48:29.270 --> 48:31.390 Alexis, you want to speak about that a little bit? 48:31.390 --> 48:32.930 Yeah, sure. 48:32.930 --> 48:45.190 There's several projects that we have right now that definitely, you know, we're always open to people contributing certain things, especially when you have a certain fringe case that you feel may apply to others. 48:45.190 --> 49:00.750 When you bring things like that up in the repo, we pay attention, and we do our best to try our best to actually accommodate these scenarios and cases because we know people who use our tools are trying to stay safe online and private online. 49:00.750 --> 49:02.430 So there's HTTPS Everywhere. 49:02.430 --> 49:04.390 That's a project that I'm the lead on. 49:04.390 --> 49:08.910 And we have Privacy Badger, which is another web extension that you all may use. 49:08.910 --> 49:12.050 And we have CertBot, and we have Panopticlick. 49:12.050 --> 49:14.630 I don't think Panopticlick is open source, actually. 49:14.650 --> 49:17.710 It may be, but it's another tech project that we have. 49:20.350 --> 49:22.510 People can find this all on GitHub, right? 49:22.510 --> 49:24.030 Yeah, GitHub. 49:24.030 --> 49:35.730 And if you go on EFF.org under tools, I believe there's a whole menu that lists our tools that we have and the ways you can use them and how you can download them for yourself or get involved. 49:35.730 --> 49:45.330 With HTTPS Everywhere in particular, we have community sourced rule sets for sites out there that may support HTTPS. 49:45.330 --> 49:48.870 And a lot of those sites don't actually enforce it, as you may know. 49:48.870 --> 49:52.710 So a lot of our rules tend to those scenarios in particular. 49:53.010 --> 50:02.730 But if you could contribute to those projects and actually be able to contribute quite a bit of pull requests, we pay attention. 50:02.730 --> 50:09.830 So people on HTTPS Everywhere project, actually, when they contribute over a certain amount of time, we tend to ask them to be rule set maintainers. 50:09.830 --> 50:17.890 And those are a higher level privilege of maintainers that help us in the repo and work together with us in the actual organization. 50:17.890 --> 50:21.630 And we actually coordinate with our maintainers in HTTPS Everywhere. 50:21.630 --> 50:26.270 I can't speak to every project, but that's kind of like a little bit of how you can get involved. 50:27.330 --> 50:29.330 All right, super. 50:29.330 --> 50:31.690 So another question we got here. 50:31.690 --> 50:35.430 Can I get free EFF swag like stickers? 50:35.450 --> 50:37.710 Well, we are a nonprofit organization. 50:37.710 --> 50:45.530 We are supported by people like you who help donate to keep the organization going. 50:45.530 --> 50:54.570 And so we ask that people make a donation, and then we thank them for that donation with wonderful swag like stickers. 50:54.570 --> 51:05.850 But at fairly low donation amounts, you can get some amazing stickers at supporters.eff.org or just go to the website, the donate page. 51:06.670 --> 51:15.170 And, you know, those costs, especially now when we can't be in person at DEF CON and just hand something to somebody, we have to ship it to you and such. 51:15.430 --> 51:19.390 So I think it would be great if you want to get some of those stickers. 51:19.390 --> 51:20.710 We'd love for you to have them. 51:20.710 --> 51:26.250 But if you just pop by the website and give a donation, we'd be happy to set you up. 51:28.150 --> 51:32.070 And let's see, there's another question here. 51:32.110 --> 51:42.930 What kind of risks do non-California consumers have when posing as a Californian in hopes they could get CCPA rights? 51:42.930 --> 51:53.490 I think in a lot of cases where you're asking to say I remove my consent or you're asking for the information, you can do that without really saying where you are from. 51:54.190 --> 51:56.530 And it probably would work out. 51:56.530 --> 51:59.510 But, you know, I can't recommend that you lie. 51:59.510 --> 52:02.930 You know, I can end up getting to a weird place later. 52:02.930 --> 52:12.470 But you can probably get pretty far with just filling out the forms, saying you do not consent. 52:12.770 --> 52:25.290 And it is, I think, for a lot of the companies that are trying to be honorable about this, they are applying it on purpose, applying it to everybody. 52:25.290 --> 52:31.870 This is more difficult for them to differentiate between one database and the other of California and non-Californians. 52:31.890 --> 52:37.450 Especially if you're a non-California, but you happen to be in California, you're still protected by the California law. 52:37.450 --> 52:44.010 It looks like if you're an American citizen and you are in the European Union, you are protected by the GDPR. 52:44.010 --> 52:47.850 So it is a lot better for the companies. 52:47.850 --> 52:51.830 And I urge them to all to just try and be cool about these requests. 52:51.830 --> 53:00.110 And if somebody says, I withdraw my consent and you are relying upon that consent for processing their data, maybe stop. 53:00.110 --> 53:02.890 That would be like a nice thing to do and not be a jerk about. 53:04.260 --> 53:06.180 All right. 53:06.900 --> 53:09.940 So what other questions? 53:10.480 --> 53:17.500 Any biometric data laws like Illinois' brewing in other states? 53:17.500 --> 53:23.080 So Illinois, they had a biometric privacy law. 53:23.080 --> 53:37.360 There was recently a, I think it was proposed 600-ish million settlement against Facebook for violating the Illinois biometric law, which is a, you know, Facebook makes a lot of money, but you know, still 600 million. 53:37.360 --> 53:42.780 So you'd notice, you know, you still got to write it in up in the annual report. 53:43.360 --> 53:47.920 So it turned out to be a very powerful law, that case. 53:47.920 --> 53:59.280 And also that law is being used for a suit against Clearview, the company that scooped up all the photos they could find online to make a massive facial recognition database. 53:59.280 --> 54:10.080 But I actually don't know, does anybody know if there are any similar bills moving forward outside of Illinois? 54:13.500 --> 54:14.340 I guess not. 54:14.340 --> 54:18.280 We don't have a member of the ledge team on today's program. 54:18.280 --> 54:27.280 So one of the things that we have seen a lot of for biometrics is facial recognition bans. 54:27.280 --> 54:29.960 These are usually at the municipal level. 54:29.960 --> 54:40.240 So there's a lot of municipalities that have banned their governments and especially their police departments from using facial recognition. 54:40.360 --> 54:46.300 And a lot of the EFA groups have been supportive of that effort. 54:46.300 --> 54:50.280 And this is, yes, CCOPS is the general name of it. 54:50.280 --> 55:06.320 Community Control Over Police Surveillance Ordinances, which is basically the idea that the elected representative, the city council, should have control over what surveillance techniques are being used or should never be used against their citizens. 55:06.320 --> 55:27.020 And with, you know, all the police departments getting pressure to add more surveillance, getting funding from DHS to buy more surveillance, getting deals proposed by companies like Ring to get more surveillance installed by the consumers, it's very important to have these kinds of ordinances. 55:27.020 --> 55:29.520 And again, the EFA has worked a lot with that. 55:29.520 --> 55:37.600 So maybe this makes this a wonderful moment to begin our transition over to the Meet the EFA portion of our program tonight. 55:37.600 --> 55:45.380 So I would like to please join me in thanking our panelists, Hannah, Rory, Eva, and Alexis. 55:46.020 --> 55:50.960 It's been wonderful doing another Ask the EFF with DEF CON again. 55:50.960 --> 55:52.540 I miss you all so much. 55:52.540 --> 55:56.680 I wish I was there in person to say hello to you all. 55:56.820 --> 55:58.180 Indeed, indeed. 55:58.180 --> 56:01.760 But we will hopefully see you next year. 56:02.040 --> 56:03.140 And thank you. 56:03.140 --> 56:06.540 And then panelists, you want to say any last comments? 56:09.650 --> 56:10.250 Thank you. 56:10.250 --> 56:10.410 All right. 56:10.410 --> 56:15.910 Well, let's do the transition to the Meet the EFA panel. 56:16.610 --> 56:17.550 Hello. 56:17.550 --> 56:18.530 Thank you, Kurt. 56:18.530 --> 56:20.030 And thanks to all of you. 56:20.030 --> 56:21.090 So yes, I'm Nash. 56:21.090 --> 56:27.250 I am the Associate Director of Community Organizing at the Electronic Frontier Foundation, where I lead the organizing team. 56:27.410 --> 56:31.010 Rory joins me also as well as a member of the organizing team. 56:31.010 --> 56:39.450 And we help coordinate the Electronic Frontier Alliance, which is a network of over 70 community and student-led and grassroots organizations around the country. 56:39.450 --> 56:42.750 So before we jump into that, I would just first join everyone else. 56:42.750 --> 56:44.690 Everyone in the chat has been really excellent about it. 56:44.690 --> 56:51.290 I also want to join them in thanking Alexis and Rory and Hannah and Eva and Kurt for everything that they shared. 56:51.290 --> 56:56.890 It's really an honor to work alongside inspiring folks like you and the rest of our colleagues at EFF. 56:56.890 --> 56:59.330 I also want to thank everyone here who supported EFF. 56:59.330 --> 57:11.790 I see in the chat, there's lots of folks that are talking about, you know, the different swag and donations and support that you've given us throughout the years and that hopefully we'll continue to do the work that inspires you to do that going forward. 57:11.790 --> 57:19.550 So thanks to all of you for the last 30 years and in advance for your support as we continue to fight for digital rights and free expression for decades to come. 57:19.550 --> 57:36.810 And with that said, one of the things that I enjoy the most about my role at EFF is supporting grassroots and student-led organizations around the country that are working to preserve digital rights in their communities and empowering their neighbors with the information that they need to make informed choices about the way they interact with technology and the Internet. 57:36.810 --> 57:44.470 So in this next portion of our time together, we're going to speak with representatives of four Electronic Frontier Alliance-affiliated groups. 57:44.950 --> 57:54.770 And then I think that the folks that are joining now would agree with me when I say that the work that they do isn't easy work, but it's work that all of us can be engaging in wherever we are. 57:54.770 --> 58:01.650 It's great, folks like Eva and Kurt and Alexis and Rory, you're all brilliant experts that are doing inspiring work. 58:01.650 --> 58:08.390 But really, all of you are the experts in what the potential is and the ways to support and the threats in your own community. 58:08.390 --> 58:22.490 So I hope that in addition to learning from the folks that we're going to hear from now, it may also inspire you to either join into the work that's already happening if there's a group in your community, or to launch a group that could also be joining them in that fight based in your area. 58:22.490 --> 58:26.090 So welcome to the Meet the FAA portion of our session. 58:26.350 --> 58:29.270 And first person I want to introduce is Tracy Rosenberg. 58:29.790 --> 58:37.430 Kurt spoke a little bit about community control over police surveillance, and the local bans that have been passed on face surveillance. 58:37.450 --> 58:43.650 And Tracy is, in addition to being the Executive Director of Media Alliance, is a member of Oakland Privacy. 58:43.650 --> 58:51.910 And Oakland Privacy was instrumental in passing some of the first and some of the strongest community control over police surveillance bans, as well as bans on face surveillance. 58:51.910 --> 59:01.330 And so, yeah, so Tracy, Oakland Privacy really has a remarkable origin story, as well as a unique organizing model and stunning list of successful campaigns. 59:01.330 --> 59:09.470 Can you tell us a bit about Oakland Privacy's mission, and how the group was formed, and maybe divulge a little bit of the secret sauce that makes Oakland Privacy so successful? 59:11.190 --> 59:12.510 Absolutely, Nash. 59:12.510 --> 59:16.470 First of all, I just want to say I'm sorry, my camera's acting up. 59:16.470 --> 59:25.470 So I'm going to go ahead and say a couple of things, and then hopefully I'll be able to see everyone in person as we work through the panel. 59:25.470 --> 59:26.250 Sorry about that. 59:26.250 --> 59:26.930 I don't know. 59:27.090 --> 59:27.930 Technology. 59:28.470 --> 59:48.210 So Oakland Privacy was originally the privacy wing of the Occupy Oakland encampment, which as some of you probably know, is a fairly militant and fairly late Occupy encampment back in 2011. 59:49.210 --> 01:00:02.510 Folks were basically wanting to sort of understand all of the equipment and devices and technology that was being used on them by the very many police that were in the proximity. 01:00:02.510 --> 01:00:14.850 Once Occupy Oakland broke up, you know, you can never be too paranoid because we were doing PRAs and taking a look at stuff. 01:00:14.850 --> 01:00:23.050 And we found a Homeland Security project called the DAC or Domain Awareness Center. 01:00:23.050 --> 01:00:34.790 It was a citywide surveillance gauntlet that essentially was about 30% of the way implemented and nobody knew that it was going on at all. 01:00:34.790 --> 01:00:37.550 We mobilized the entire city. 01:00:37.550 --> 01:00:41.050 We stopped it in the spring of 2014. 01:00:41.130 --> 01:00:49.790 And then we devoted ourselves to trying to make sure that nothing like this would ever happen again here or anywhere else. 01:00:49.790 --> 01:00:53.670 So we were talking a bit about CCOPS ordinances. 01:00:53.670 --> 01:01:04.070 And basically, we've been trying to implement that framework, which allows for reporting and consent, and when necessary, bans. 01:01:04.070 --> 01:01:08.490 And we are at about 11 or 12 cities nationwide. 01:01:08.490 --> 01:01:16.290 And I believe the 11th facial recognition ban just went into place last week in Portland, Maine. 01:01:16.290 --> 01:01:17.070 Awesome. 01:01:18.090 --> 01:01:19.290 I'm so eager to learn. 01:01:19.290 --> 01:01:21.170 There's so much of that I want to dig more into. 01:01:21.170 --> 01:01:24.290 But first, I want to make sure we get a chance to speak with the rest of our panelists. 01:01:24.490 --> 01:01:28.330 And so the next person I want to introduce is Elliot from Cypert Collective. 01:01:28.530 --> 01:01:36.130 And Elliot is a motion artist and a creative coder who works in interactive fabrication and large-scale immersive experiences. 01:01:37.210 --> 01:01:42.950 And Elliot blends visual work with an interest in mutual aid, security, and privacy online. 01:01:42.950 --> 01:01:47.710 And so it's funny, in Elliot's bio, it also mentions that Elliot is based in Brooklyn. 01:01:47.710 --> 01:01:51.870 Cypert Collective is one of the earliest members of Electronic Frontier Alliance, and they're based in Brooklyn. 01:01:51.870 --> 01:02:01.390 But I always think, as someone who's also from Brooklyn, I always think it's funny how, you know, when you're... it doesn't take very long to know when someone is from Brooklyn, because they tell you almost immediately. 01:02:01.390 --> 01:02:06.630 And so I want to welcome Elliot to the panel here. 01:02:06.690 --> 01:02:15.890 And so thanks for representing Brooklyn, and thanks for all of Cypert Collective out there doing work to inform folks and give them the information that they need to make informed choices in their technology. 01:02:16.090 --> 01:02:23.350 And we're all gathering right now in safe mode today because of the need to protect ourselves and our communities from the global pandemic. 01:02:23.350 --> 01:02:29.730 But in normal non-COVID times, Cypert Collective puts on a range of workshops, socials, and other events. 01:02:29.970 --> 01:02:31.650 Elliot, why is that? 01:02:31.650 --> 01:02:33.710 Why not just stick to one format? 01:02:34.370 --> 01:02:37.330 Well, I guess I should start by saying that I am from Brooklyn. 01:02:38.410 --> 01:02:40.170 Now that we've gotten that out of the way. 01:02:40.170 --> 01:02:41.650 Brooklyn is in the house. 01:02:41.650 --> 01:02:42.410 Yeah. 01:02:42.910 --> 01:02:45.750 It's the least I could do. 01:02:45.890 --> 01:02:57.730 So to your question, I think that, you know, a big part of Cypert's mission and what we've been trying to do over the last few years is to make security accessible to everyone. 01:02:57.730 --> 01:03:03.870 And I think that that is key to why we have so many different types of events. 01:03:04.050 --> 01:03:14.630 Because, you know, we're trying to rather than kind of present one way to learn about security that some people might... it might work for some people and it might not work for others. 01:03:14.630 --> 01:03:20.250 We want to have... we want to be able to meet people in the way that they're comfortable. 01:03:20.250 --> 01:03:34.370 And I think that part of that is having a lot of events so that we can teach in ways that people are comfortable learning and also to kind of, you know, bring a social aspect to security and try and build a community around it. 01:03:34.370 --> 01:03:44.550 I think all of which makes it easier for the average person to feel comfortable with and then being comfortable start to educate themselves about security. 01:03:45.330 --> 01:03:46.050 Absolutely. 01:03:46.050 --> 01:03:47.350 I couldn't agree with that more. 01:03:47.430 --> 01:03:50.270 And so, next I'm going to introduce Abhi. 01:03:50.270 --> 01:03:52.170 And Abhi is with Black Movement Law Project. 01:03:52.170 --> 01:03:54.290 We use the abbreviation BMLP. 01:03:54.290 --> 01:03:57.870 And in full disclosure, Abhi and I have worked together for a number of years. 01:03:57.870 --> 01:04:09.750 And in fact, after years of doing legal support work in a range of contexts, Abhi, also International Human Rights Attorney Nicole Lee and myself started BMLP to support the building of Black-led legal support infrastructure in the US. 01:04:09.750 --> 01:04:19.130 And it was actually Abhi's idea, way before I joined the team at EFF, for BMLP to join the Electronic Frontier Alliance and for us to do our first round of digital security workshops. 01:04:19.330 --> 01:04:22.510 In addition to work with BMLP, Abhi is an attorney and technologist. 01:04:22.510 --> 01:04:27.830 He's currently a partner at O'Neill and Hassan LLP, a law practice focused on indigent criminal defense. 01:04:27.830 --> 01:04:35.810 And prior to his work with BMLP and some of the other work that he's engaged in right now, he was the Mass Defense Coordinator at the National Lawyers Guild. 01:04:35.870 --> 01:04:43.550 Shout out to National Lawyers Guild and all the work that they're doing across the country to support folks that are raising their voices to call for justice and an end to police violence. 01:04:43.850 --> 01:04:49.890 And Abhi has also worked as a political campaign manager and strategist, union organizer, and community organizer. 01:04:49.890 --> 01:04:55.310 And Abhi conducts trainings, speaks, and writes on topics of race, technology, injustice, and the law. 01:04:55.310 --> 01:05:05.110 Now, Abhi, a lot of the EFA groups fit into one of three boxes, or some of them span, like Lucy Parson's lab does digital security trainings, as well as advocacy work. 01:05:05.390 --> 01:05:13.510 But those boxes generally fall into ones that are popular, like Cyber Collective, that focus on popular education about technology and privacy. 01:05:13.630 --> 01:05:14.850 There's also Hacker Spaces. 01:05:14.850 --> 01:05:17.730 I know there's folks in the chat right now from Crash Base in Los Angeles. 01:05:17.730 --> 01:05:20.590 Thanks, y'all, for joining us and all the work that you're doing out there. 01:05:20.590 --> 01:05:29.250 And then there's also the Hacker Spaces, where folks are sharing tools and skills and resources, and obviously the advocacy groups like Oakland Privacy. 01:05:29.330 --> 01:05:31.670 But BMLP is a bit of an outlier. 01:05:31.690 --> 01:05:39.110 As the movement is changing, and what are some of the ways that movement law can expand to meet the need of growing social movements? 01:05:39.110 --> 01:05:51.650 And why is, for a group like BMLP, that is focusing on, you know, providing legal support infrastructure to support folks that are engaged in first amendment protected activity, why is digital security and privacy important? 01:05:51.650 --> 01:05:55.610 How did that become such an integral part of your work? 01:05:58.090 --> 01:06:01.210 Yeah, so, yeah, thank you, Nash. 01:06:01.770 --> 01:06:04.250 Thank you for the very nice introduction. 01:06:04.250 --> 01:06:09.910 Look, I got to preface this with saying, none of us know what we're doing, right? 01:06:09.910 --> 01:06:21.970 We're in an unprecedented moment where we all have to rethink and be on our toes and be flexible in how we're engaging with everything, right? 01:06:21.970 --> 01:06:42.170 And so that, you know, that's my disclaimer, but like, you know, as far as the work that we've done, you know, we, like, as you mentioned, started doing this kind of legal support movement, legal support work, specifically, you know, in 2015-2016. 01:06:42.170 --> 01:06:54.990 And we just, you know, responded with kind of the grassroots calls we got for, I mean, we joined the EFA because people were asking us about digital security. 01:06:54.990 --> 01:06:57.770 And so we had to develop a digital security plan. 01:06:57.770 --> 01:07:09.830 We partnered with EF, with EFF and helped with, you know, EFA and all of the, like, really great work that EFF has been doing to build on that digital security training infrastructure. 01:07:09.830 --> 01:07:19.370 But like, now we're in this point where it's like, you know, I want to, I think that that space of digital security training has grown. 01:07:19.370 --> 01:07:27.270 And like, you know, because of CYPR, EFA, EFF and other organizations, it's like, that space has grown. 01:07:27.270 --> 01:07:36.930 And I think that we need to also start expanding what we're doing as movement technology people, like, and start thinking bigger, right? 01:07:36.930 --> 01:07:44.630 Like, also, like, we need to do that, that kind of core organizing work and that core digital security work. 01:07:44.630 --> 01:07:59.870 But I think we also need to think about how we're building at a different level, movement infrastructure, how we're building at a different level, the types of, you know, how we incorporate technology in a holistic way with how we build movements. 01:07:59.870 --> 01:08:05.010 And like, that is more than that, that is a big project. 01:08:05.010 --> 01:08:27.910 And so that's kind of where I see us going, where we're like, not, we're thinking about how we can build mass scale infrastructure and how we can, and how we can engage just at different levels more than just that digital security level. 01:08:27.910 --> 01:08:30.570 And so that's kind of where I want to see us going. 01:08:30.570 --> 01:08:34.510 And that's what I hope BML can be part of building. 01:08:34.790 --> 01:08:47.010 Yeah, and I appreciate, you know, speaking of in terms of movement and encouraged in terms of the ways that that work is essentially to support work that people are doing to knock down systems, you know, traditional systems of marginalization and oppression. 01:08:47.410 --> 01:08:55.790 And that part of that is making sure that they're able to keep their information and their communication secure and that technologists are communicating in effective ways with the folks that are doing that work. 01:08:55.790 --> 01:09:00.370 In keeping with that, actually, it's a great opportunity to introduce Emily St. 01:09:00.370 --> 01:09:01.830 Pierre, it's really my honor. 01:09:01.830 --> 01:09:08.370 And Emily is the security ambassador for FutureAda, a Spokane-based nonprofit advocating for diversity and inclusion in STEAM. 01:09:08.490 --> 01:09:13.430 I don't think I need to tell folks here, security, technology, engineering, arts and mathematics, this is DEF CON. 01:09:13.690 --> 01:09:22.250 For the past six years, Emily has used her experience as an offensive security professional to provide privacy and security education within her community. 01:09:22.250 --> 01:09:34.350 Now, through Emily's work with FutureAda, Emily has established free regular workshops and one-on-one technical support to the Spokane community, so folks in Spokane, Washington, definitely look out for FutureAda. 01:09:34.350 --> 01:09:42.270 Now, Emily's focus has been to make sure that these resources are explicitly available to underrepresented and under-supported members of the public. 01:09:42.370 --> 01:09:46.550 Now, Emily, FutureAda is one of my favorite names in the Alliance, to be honest. 01:09:46.550 --> 01:09:48.770 Don't play favorites, but it's one of my favorite names. 01:09:48.770 --> 01:09:56.090 Can you start off by telling us a bit about the significance of that name and what need in your community FutureAda was launched to address? 01:09:56.870 --> 01:09:57.930 Thanks, Nash. 01:09:57.930 --> 01:10:01.750 I have to say, speaking of favorite names, I love Cypher as well. 01:10:02.950 --> 01:10:11.430 So, FutureAda is named after the Countess of Lovelace, or Ada Lovelace, who was a mathematician and a writer. 01:10:11.430 --> 01:10:14.550 She's often recognized as the first computer programmer. 01:10:14.870 --> 01:10:21.370 And FutureAda was founded by my wonderful colleague, Rebecca Long, in 2017. 01:10:21.990 --> 01:10:38.370 And so, after facing, you know, many challenges in the industry, in IT, you know, she had a vision to start a nonprofit, which would help promote, you know, diversity and inclusion, you know, within those areas of STEAM, as you mentioned. 01:10:38.370 --> 01:10:58.230 And this is all in the hopes, you know, of helping the future Ada Lovelaces of tomorrow, you know, realize their potential, no matter their background, no matter how they identify and present themselves, you know, everyone deserves to be and feel included and to thrive within the areas of STEAM. 01:10:58.230 --> 01:11:08.750 Our nonprofit also puts on and participates in events to help promote interest in these areas around Spokane, Washington, and sometimes Coeur d'Alene, Idaho. 01:11:09.610 --> 01:11:18.610 And my role as security ambassador is really to, you know, first and foremost, promote interest in privacy and security within our community. 01:11:18.610 --> 01:11:35.230 And, you know, secondly, to provide access to privacy and security professionals to underrepresented groups, but also, you know, we are open to the general public, because we feel that security and privacy is something that should be available to everyone. 01:11:36.030 --> 01:11:36.750 Awesome. 01:11:36.750 --> 01:11:49.370 Now, Emily, you know, given that we are here at DEF CON, I have a question for you in that, like, what are some of the things in your experience and given your unique perspective, what are some of the things that folks in the hacker community and folks in DEF CON could, 01:11:49.370 --> 01:12:04.410 like, what are some things you'd like to see them doing and being able to support the work that you're engaged in and some of the other work to give folks the information and power to be able to engage responsibly with their tech and the larger sector? 01:12:05.230 --> 01:12:07.150 Yeah, that's a good question. 01:12:07.150 --> 01:12:17.430 I thought about that a lot this week, you know, and I'd love to see hackers building more bridges with other communities outside of InfoSec. 01:12:17.430 --> 01:12:39.290 You know, I've seen amazing projects come out of these types of collaborations, such as, you know, this paper presented at the USENIX Security Symposium last year by Sam Haven, and Haven and other researchers, you know, from Cornell Tech and NYU, they came up with a model where security professionals, 01:12:39.290 --> 01:12:47.250 you know, are integrated into the support infrastructure, you know, for victims of intimate partner violence. 01:12:47.250 --> 01:13:01.850 So they can help, you know, those victims or clients, as they call them in the model, they can help them assess whether or not their devices or accounts are being used or have the potential to be used for surveillance, you know, by their abusive partner. 01:13:01.850 --> 01:13:11.550 And we love that model so much at Futurada that we actually implement kind of a version of it to all of our, you know, one-on-one consultations. 01:13:11.550 --> 01:13:35.950 And if there's anything I can do to, like, I really want to encourage, you know, everyone who's listening to be a security and privacy advocate, you know, and you can do that by, you know, volunteering, you know, and there are plenty of organizations around you that would benefit from having a professional work with them to help them understand and address their privacy and security concerns, 01:13:35.950 --> 01:13:46.450 kind of like the example I just talked about, you know, and that can be, you know, your local youth center, your local shelter, you know, any organization nearby. 01:13:46.450 --> 01:13:57.430 And if you don't have time, you know, to volunteer, you know, even doing something as simple as having conversations about security and privacy with people around you. 01:13:57.430 --> 01:14:12.670 Not only will that be a great opportunity to teach folks about these topics, but it will help you learn about and better understand threat models and privacy and security needs that you may not be aware of. 01:14:12.810 --> 01:14:16.670 And I really want to encourage everyone to that. 01:14:16.670 --> 01:14:21.270 So not just help teach, but also help understand and listen. 01:14:21.970 --> 01:14:22.830 Thanks, Emily. 01:14:22.830 --> 01:14:36.970 And so that actually, and one of the things that the Alliance does is creates an opportunity for groups that are working across the country to be able to share skills and tools and resources in that way, so they can be more effective at being that person in their community. 01:14:37.270 --> 01:14:47.330 So I think that gives us an opportunity to address one of the questions that came up in the chat, and which is, the question is, can I make my college's cybersecurity club an EFA group? 01:14:47.330 --> 01:14:48.590 And I can answer that. 01:14:48.590 --> 01:14:59.710 And I can say, yes, if you have more than three folks, and you have openly accessible meetings that create an opportunity for folks to connect and support the work that your group is doing. 01:14:59.770 --> 01:15:09.270 Obviously, in, you know, before March of this year, that meant like having an opportunity, you know, having a space where folks could come and enjoy a training or meet and connect with folks. 01:15:09.270 --> 01:15:14.930 Now we have to obviously be much like, you know, the safe mode of DEF CON, be a lot more creative in how we create opportunities for that. 01:15:14.930 --> 01:15:21.290 But I want to ask, so I hope that that's answered the question around, can someone make their college's cybersecurity club an EFA group? 01:15:21.290 --> 01:15:24.530 Absolutely, reach out to us at organizing at EFF.org. 01:15:24.530 --> 01:15:27.570 Check out EFF.org slash fight to find out more about the Alliance. 01:15:27.570 --> 01:15:33.210 But I also want to, like, kind of rephrase that question and put it out to the panelists here. 01:15:33.570 --> 01:15:39.170 And, you know, what were some of the things that, like, why did your group decide to become a part of the Alliance? 01:15:39.170 --> 01:15:45.270 And, you know, what was the, what, how did you, how did you, I know it's like cyber collective organizes like very horizontally, right? 01:15:45.270 --> 01:15:50.050 And so they work in a way that, you know, make sure that everyone's voice is heard in the decisions that they're making. 01:15:50.090 --> 01:16:03.250 So I'm curious, you know, what was the, you know, if you have some insight into how your group decided to join the Alliance, but also, like, what are some of the things that the opportunities, benefits and reasons that you might, if someone was asking you if they should join the Alliance, 01:16:03.250 --> 01:16:04.750 what are some of the things that you would share? 01:16:04.750 --> 01:16:09.290 And so maybe I'll start off with you, Elliot, and then we can work around. 01:16:10.990 --> 01:16:30.510 So, I mean, I think it's a big topic, but I think that one of the reasons we wanted to join the EFA was to kind of expand upon sort of one of our organizing principles, which is, you know, a big thing that we've always tried to do is be big and have collaboration be an important thing. 01:16:30.510 --> 01:16:50.590 So that instead of us just saying, like, you know, we kind of have this knowledge and we're just pushing it out, sort of not so sensitive to the context or accessibility or any of those things, have kind of it be more of a sharing process that allows for a lot of collaboration and allows us to learn as well. 01:16:50.590 --> 01:17:02.590 And I think that, you know, the opportunity to join the EFA really gave us an opportunity to collaborate with a lot of other fantastic groups around the country and the world. 01:17:02.810 --> 01:17:11.310 And so in that way, we saw it as just sort of a natural extension of what we were trying to do at the local level. 01:17:12.050 --> 01:17:13.190 Thank you. 01:17:13.270 --> 01:17:18.250 Tracy, I know Oakland Privacy was in the Alliance before I started at EFF. 01:17:18.250 --> 01:17:21.810 And so I'm wondering, how did the Oakland Privacy originally become part of the EFA? 01:17:21.810 --> 01:17:23.850 And what's that relationship been like for y'all? 01:17:29.270 --> 01:17:30.710 We may have lost Tracy. 01:17:30.710 --> 01:17:33.410 I know Tracy was having some problems with the camera. 01:17:33.410 --> 01:17:38.650 So maybe I'll pass that question to Emily before I've got another great question I want to ask Abby. 01:17:38.650 --> 01:17:39.670 So I'll pass it to Emily. 01:17:39.670 --> 01:17:41.250 And then, yeah, what are your thoughts? 01:17:41.250 --> 01:17:42.270 Great. 01:17:42.450 --> 01:17:51.730 So we joined the EFA because we, you know, there's plenty of smart and creative and wonderful people part of the Alliance. 01:17:51.730 --> 01:17:57.970 And so we knew there was so much we could learn, you know, from other folks and other organizations. 01:17:57.970 --> 01:17:59.430 And we definitely have. 01:17:59.430 --> 01:18:08.550 You know, I definitely was not as well-versed in activism until we joined the EFA. 01:18:08.550 --> 01:18:13.990 And I've learned of so many different resources, thanks to being a member. 01:18:14.430 --> 01:18:17.250 And we're also, Oakland, Washington is pretty small. 01:18:17.250 --> 01:18:18.810 Not everyone knows where we are. 01:18:18.810 --> 01:18:21.030 Like, we're a pretty small community. 01:18:21.030 --> 01:18:31.390 And it's really helped us, you know, get our message across and, you know, tell our community about, you know, everything that we offer, the workshops we offer. 01:18:31.390 --> 01:18:33.450 So it's been really helpful for that. 01:18:33.450 --> 01:18:43.250 And along that lines, and finding out more about Future AIDA, keep your eyes out for a blog that I'm going to be releasing soon with a profile on Future AIDA and the amazing work that they do. 01:18:43.530 --> 01:18:45.310 And so it sounded like, Tracy, you sound like you're back on. 01:18:45.310 --> 01:18:48.270 Did you want to add, did you want to speak to Oakland Privacy and EFA? 01:18:49.090 --> 01:18:50.810 Yeah, totally. 01:18:50.810 --> 01:19:00.830 I think what's been exciting for us about EFA is just seeing so many models in terms of how people do work. 01:19:00.830 --> 01:19:15.230 Because the challenge, of course, is that one way or the other, you're a fairly small collective, and you're dealing with these big, heavy, weighty, important issues and challenges. 01:19:15.230 --> 01:19:19.910 Really, you know, everything about internet freedom and digital security. 01:19:19.910 --> 01:19:22.570 It's a huge range of issues. 01:19:22.570 --> 01:19:33.150 And there's so many different and interesting and creative ways that sort of groups of people get their mind around sort of how to tackle it and how to approach it and what to do first. 01:19:33.150 --> 01:19:43.870 And EFA is really just like an encyclopedia of what, you know, five or eight or 10 people can come up with in terms of, okay, what should we do first? 01:19:45.330 --> 01:19:46.030 Thank you. 01:19:46.030 --> 01:19:46.310 Yeah. 01:19:46.310 --> 01:19:56.170 And that's actually, that's the favorite, my favorite part of the job is like working with folks to figure out like what is going to be not, you know, not that like, it's like a one size fits all, like what we did here is going to work there. 01:19:56.170 --> 01:20:05.990 But like, how do we take lessons that were learned in one area and be able to figure out how they can adapt and be most effective for a different community in the context of that community is working in. 01:20:05.990 --> 01:20:06.710 So absolutely. 01:20:06.710 --> 01:20:07.510 Thank you, Tracy. 01:20:07.770 --> 01:20:09.630 Avi, I'm going to give you a different question. 01:20:09.630 --> 01:20:10.510 Did you want to speak to that one? 01:20:10.510 --> 01:20:11.910 Because I want to give you a different question. 01:20:11.910 --> 01:20:12.930 Just real quick. 01:20:12.930 --> 01:20:25.890 I just want to say that that's really like people who are thinking about joining EFA and getting involved and trying to apply their technical skills to larger political projects. 01:20:25.890 --> 01:20:38.710 I think it's crucial to understand that like the skills you develop, if you're actually doing threat modeling, if you're actually doing analysis, you are actually doing a form of political analysis as well. 01:20:38.710 --> 01:20:51.750 You are doing an act like if you're doing a good threat model, you are doing a material analysis of the like organizational and institutional opponents to like human freedom, basically. 01:20:51.750 --> 01:20:58.770 And so like you really like you, again, I want to warn the tech people, you don't actually know it all already. 01:20:58.770 --> 01:21:18.110 But like you have if you've developed those skills, you've developed some insight and the ability to collaborate and coordinate with more overtly political organizations and apply those like actual material reality assessing skills can be incredibly valuable, 01:21:18.110 --> 01:21:26.890 especially if you approach it with like a kind of like humility and openness, you know, so that's all I'll say about that. 01:21:26.890 --> 01:21:27.610 Yeah, no, that's right. 01:21:27.610 --> 01:21:39.350 And when you're saying that it made me think about the security education companion, which is like a really an example of a tool that we were getting at EFF, we were getting lots of folks that were asking us, especially, you know, following the last presidential election cycle, 01:21:39.350 --> 01:21:44.610 that were concerned about the impact that there was going to have on their communities and want to make sure that folks had information. 01:21:44.850 --> 01:21:51.330 And we thought about, you know, what could EFF just like, you know, parachute into different communities and have the answer and be able to provide it. 01:21:51.330 --> 01:21:55.090 And we realized that that wasn't a responsible or sustainable model. 01:21:55.090 --> 01:22:09.090 And so we have, with help of groups in the EFA, have developed the security education companion, which helps folks that are either maybe great teachers and facilitators but need some help in making sure their trainings effectively convey the intricacies of the technology, 01:22:09.090 --> 01:22:15.210 or the other way around where they're technologists and need help to be able to adapt their pedagogy skills and what have you. 01:22:15.210 --> 01:22:17.050 And so security education companion is also great. 01:22:17.050 --> 01:22:22.750 So if you're in your community and want to be a resource for folks in your community, that's a great tool and resource. 01:22:23.050 --> 01:22:33.010 And Abhi, the question that I want to ask you that fits right perfectly on top of that is, how would you recommend, this comes from the chat, and so I'm going to read it the way it's worded. 01:22:33.010 --> 01:22:39.310 How would you recommend those of us who may not be members of the communities that most need security, i.e. 01:22:39.310 --> 01:22:45.270 cis white males, build trust and truly collaborative relationships with communities who most need security? 01:22:47.750 --> 01:22:51.210 I mean, you know, that's a tough question. 01:22:51.210 --> 01:22:53.270 I mean, I don't think there's one answer. 01:22:53.270 --> 01:22:58.630 I think building off what I just said, it's kind of like, it's really about how you approach the issue, right? 01:22:58.630 --> 01:23:04.850 Like, what are you, like, again, like, you have something to offer, you have something to learn. 01:23:04.850 --> 01:23:13.470 And if you approach things with that perspective, you know, you're going to do much better than if you approach things from the perspective of I know everything or whatever. 01:23:14.210 --> 01:23:21.510 But, you know, I think that the name of the game is, is how do we build solidarity, right? 01:23:21.510 --> 01:23:35.050 How do we build relationships and networks that are collaborative, like across different identities and different communities, right? 01:23:35.050 --> 01:23:40.930 I mean, like, if we're all completely siloed forever, we will be divided and conquered. 01:23:40.930 --> 01:23:45.770 I mean, that is just, that is, like, almost a fact of history, right? 01:23:45.770 --> 01:23:53.690 So, you know, there's not one simple solution to that conundrum, right? 01:23:53.690 --> 01:24:14.810 But I do think that, like, building long lasting relationships, sustaining relationships, approaching the work with humility, approaching the work with, like, an interest in learning and like, but also approaching the work as, you know, it's a hard line, 01:24:14.810 --> 01:24:15.030 right? 01:24:15.030 --> 01:24:23.270 How do you, how do you approach work as an equal, but also recognizing difference, right? 01:24:23.270 --> 01:24:34.370 That is a hard thing to figure out, because, like, you know, I think that we often get caught up, like, it wasn't allies that won the Civil War, right? 01:24:34.370 --> 01:24:36.570 It was warriors, it was fighters, right? 01:24:36.570 --> 01:24:40.090 Like, we need, like, actual people engaged in actual struggle. 01:24:40.090 --> 01:24:42.070 We don't need people on the sidelines. 01:24:42.070 --> 01:24:49.950 But we also don't need people telling us what to do and domineering and dominating conversations. 01:24:49.950 --> 01:25:01.610 So, you know, being very conscious and open and engaging in that struggle, even internally and with other people and hashing it out and being open and honest about what you don't know. 01:25:01.610 --> 01:25:04.550 Like, that's, that's the only, that's all I can say. 01:25:04.550 --> 01:25:11.270 It's like, constantly engaging, constantly questioning, and constantly building networks and relationships of trust. 01:25:11.610 --> 01:25:12.590 Gotcha. 01:25:12.590 --> 01:25:21.230 Yeah, I mean, obviously, I've worked, I have worked really closely together and have challenged this question together. 01:25:21.230 --> 01:25:25.650 And so I absolutely couldn't agree more with what Abhi shared. 01:25:25.650 --> 01:25:28.550 Cypher Collective has an interesting thing that they do. 01:25:28.910 --> 01:25:42.290 And I'm hoping, Elliot, you'll speak a little bit because I think that's one of the things about creating that trust and an opportunity to, for folks to share kind of, like, the things that they're most concerned about and, like, their, and their things that they feel the most vulnerable about is, 01:25:42.290 --> 01:25:51.830 like, creating a space and an environment that, that, that makes that possible, that helps create a comfortability and an affinity to foster that. 01:25:51.830 --> 01:25:56.590 So, and I always, whenever I think about creating that environment, I think about security. 01:25:56.690 --> 01:26:03.230 And so I'm hoping maybe you'll share a little bit about what that is and why that model is effective that way, if it is effective that way. 01:26:03.230 --> 01:26:04.770 I think it is, but I want to hear from you. 01:26:04.770 --> 01:26:05.970 It's your event. 01:26:05.970 --> 01:26:08.450 I think it can be effective. 01:26:08.450 --> 01:26:22.790 And I think security and also a lot of other events that we have, they kind of all share in common that, you know, well, I think the overall topic might be security and definitely is security. 01:26:22.790 --> 01:26:25.430 It isn't sort of the only thing that we do. 01:26:25.430 --> 01:26:31.870 And I think that one of the reasons, you know, like at some points we have security and the whole session might not even be about security at all. 01:26:31.870 --> 01:26:38.090 And then, you know, we also have movie nights, you know, where it might not even be discussed. 01:26:38.090 --> 01:26:55.230 And I think that the reason we do that is to create a community, but I think that something that people should be aware of is that many of us come to security because we find it to be something that's intellectually interesting, or, you know, we have kind of a general moral feeling about it. 01:26:55.230 --> 01:27:06.550 But I think that something that's important to realize is that many people come to security workshops, because I guess to put it in the most simple way, they've had something bad happen to them. 01:27:06.550 --> 01:27:12.950 You know, it could be, as was mentioned earlier, intimate partner violence. 01:27:12.950 --> 01:27:22.990 It could be that they feel like the place where they work or the place where they go to school has taken advantage of them or made them feel vulnerable. 01:27:22.990 --> 01:27:31.350 And so it's coming from a place where people already have had something happen to them that gives them a problem in trusting people. 01:27:31.430 --> 01:27:48.710 And so I think that, you know, many of the things that we do that are more social are for fun, but I think it's also sort of, you know, to build an important relationship with people so that they feel comfortable really opening up about, you know, what they're looking for help with. 01:27:48.710 --> 01:27:56.750 And so I think that that is kind of why we try and do the range of events that we have to help people feel comfortable and build trust. 01:27:57.430 --> 01:27:58.010 Thank you. 01:27:58.010 --> 01:28:03.690 And so we are at time, but I want to give everyone an opportunity to kind of like leave with their closing message. 01:28:03.690 --> 01:28:08.890 And so I'm going to go around the way y'all are on my screen, which is Tracy, Avi, Emily, and Elliot. 01:28:08.890 --> 01:28:16.950 And so Tracy, I want to give you an opportunity, especially since Oakland is such a diverse community and y'all have done such amazing advocacy work there. 01:28:16.950 --> 01:28:24.090 If you want to build on to the question around like how building that trust and building that affinity and maybe even saying something about building coalition. 01:28:24.090 --> 01:28:37.470 And so if you want to talk to that and also like what is like the one thing that like if folks were wanted to wanted to to recreate or to model the work that Oakland Privacy has done in your community, what's the like the most important message you would want them to take? 01:28:38.730 --> 01:28:39.570 Right. 01:28:39.910 --> 01:28:49.170 Um, I think the most, well, the simplest thing that I could probably say is that, you know, the trust of your community is everything. 01:28:49.170 --> 01:28:50.890 We did a lot of listening. 01:28:50.890 --> 01:28:58.330 We did a lot of, um, you know, what do you want to see happen here? 01:28:58.330 --> 01:29:12.650 And we really saw ourselves as kind of the advocacy consultants, not so much, um, not so much coming in with a solution, but coming in with a here's what the community wants. 01:29:12.650 --> 01:29:20.750 And here are some tools that we can provide to sort of help us get to where we want to be together. 01:29:20.750 --> 01:29:24.890 And as we go out of Oakland to other places, that's even more important. 01:29:24.890 --> 01:29:44.530 And so we just kind of try to look for the advocacy opportunities, the thing that's happening that gives us an opportunity to sort of step up and say something and then sort of turn to the locals in partnership and say, um, you know, here are some things that we can try to achieve the goal. 01:29:44.530 --> 01:29:49.630 And the goal is, is almost always we want to have an impact on what happens. 01:29:49.930 --> 01:29:57.590 And when it comes to stuff like the spread of surveillance, it's, it's, it's all about consent. 01:29:57.590 --> 01:30:02.130 We want them to ask us and we, and we want the opportunity to say no. 01:30:03.810 --> 01:30:04.530 Absolutely. 01:30:04.730 --> 01:30:16.050 And yeah, and so and again, like the Kurt mentioned earlier, and Tracy's touched on it, and really like the community control over police surveillance ordinances are very much, you know, banning face surveillance, because face surveillance, even if it worked perfectly, 01:30:16.050 --> 01:30:21.490 the First Amendment and Fourth Amendment implications would be, would be too to stop, to stop the harm before it grows. 01:30:21.790 --> 01:30:28.990 But with the others, with the other surveillance equipment, it's really about making sure the power goes back into the community to have a voice in it and for their elected officials to make the decision. 01:30:28.990 --> 01:30:38.610 And so really thanks to Oakland Privacy for all the amazing work that you've done making that a thing, not just in Oakland, but in many cities, and with the support that you've given to folks throughout the Alliance and throughout our neighboring communities. 01:30:39.050 --> 01:30:51.390 Avi, what is like, what is the, what is, you spoke a lot about technologists facilitating and helping, working, build, building the tools and developing things to support folks that are engaged in movement work. 01:30:51.390 --> 01:30:56.950 If there's one thing that you want folks who are thinking about engaging that work, could like, what would it be? 01:30:56.950 --> 01:31:01.410 And then if you want to, we had one question I didn't get in, I didn't get a chance to respond to. 01:31:01.410 --> 01:31:09.490 So this will be an optional, this will be bonus points if you want to talk a little bit about the successes and failures of the GDPR in the limited time that we have. 01:31:09.810 --> 01:31:10.530 Go! 01:31:10.530 --> 01:31:14.950 Okay, look, so, you know, you said one thing, I'll give you three. 01:31:14.950 --> 01:31:30.750 I mean, like, I think you, one framework that I find useful to looking at this is, you know, I'm going to preach a holy trinity, right, of movement work, right, or of, you know, it's the holy trinity of time, space, and information, right? 01:31:30.750 --> 01:31:35.250 Those are the three things that we can look at, look at everything through, right? 01:31:35.250 --> 01:31:44.470 And so when we're approaching the work, what of those three can we offer and what can we bring to building, right? 01:31:44.470 --> 01:31:53.010 And they're all kind of work in a dynamic with each other, where if you have more space, you can kind of have less time and, you know, you can actually have more information, right? 01:31:53.010 --> 01:31:54.650 Like, they all work kind of together. 01:31:54.690 --> 01:32:14.450 But, like, thinking about, like, what, how we're engaging through that lens, I think, is very helpful in thinking about how we build because, like, that's how we create the bricks and mortar of building organization, of building movement, of building all the things I said before about networks, 01:32:14.450 --> 01:32:16.750 connections, and that's what we need, right? 01:32:16.750 --> 01:32:23.850 Like, our kind of opposition or, like, the forces that are working against us have those things in spades. 01:32:23.850 --> 01:32:30.430 And we are very lacking, especially in any kind of holistic vision of how we have those three things working together. 01:32:30.430 --> 01:32:34.530 So that's kind of time, space, information is my holy trinity. 01:32:35.310 --> 01:32:36.370 Thank you. 01:32:37.070 --> 01:32:46.310 And Emily, I really, I think that you, yeah, I don't think there's enough praise I could get to the work that Future Aid is doing. 01:32:46.310 --> 01:32:55.350 And also the work that you're doing pre-COVID and with COVID and trying to also not lose count of the folks who are not able to connect, like, virtually, right? 01:32:55.350 --> 01:33:00.370 Folks that, like, when you were doing events and libraries, it was easier for them to connect and to be able to do that work. 01:33:00.370 --> 01:33:05.230 And so the fact that you're keeping, you know, you're thinking about who's not in the room is really important, right? 01:33:05.230 --> 01:33:23.750 And so I really want to, like, lift up that work and say, if there's anything that you could offer to folks around, like, being able to do that work effectively and being able to center the folks who need it the most effectively in their communities, if there's some suggestions or guidance that you can offer there, 01:33:23.750 --> 01:33:24.850 we'd love to hear it. 01:33:24.850 --> 01:33:25.990 Yeah, absolutely. 01:33:26.130 --> 01:33:41.610 You know, I think there's a lot of organizations around you that, you know, have also, you know, done their work of understanding what are the some of the issues within the community that they also wish to address. 01:33:41.610 --> 01:34:04.750 And so to kind of cross-pollinate with other organizations will be a great way to learn really fast and effectively some of the issues that, you know, might be going on that you need perhaps maybe more of an expertise, like, on from someone else or you want, 01:34:04.750 --> 01:34:08.650 you know, a little bit more depth or understanding of an issue. 01:34:08.650 --> 01:34:27.570 And so to, I've really come to depend on my communications with other folks that do great work in our communities to ask them questions to learn and to see also kind of how we can address issues that I hadn't thought about. 01:34:27.570 --> 01:34:46.990 And just to be that open line of communication when they need, you know, objective security and privacy advice, as objective as I can humanly give, you know, so that they don't have to get it from a source that might be a vendor or just like not, you know, 01:34:46.990 --> 01:34:49.310 it's not an information security professional. 01:34:49.310 --> 01:34:53.630 So I do advise to do that if you can. 01:34:53.630 --> 01:34:54.370 Absolutely. 01:34:54.510 --> 01:35:03.030 Coalition building and working directly with the folks who are impacted and recognizing that, you know, you don't have to reinvent the wheel every time. 01:35:03.030 --> 01:35:08.770 You have to figure out the way that you can be most supportive in the system that's there to provide the support for folks. 01:35:08.770 --> 01:35:10.850 So thank you so much, Emily. 01:35:10.850 --> 01:35:26.290 And Elliot, I want to give you an opportunity to like whatever you think that folks should leave knowing about CYPR, but I hope that you'll also talk a little bit about one of the things I really like about CYPR is the focus that y'all put on making learning accessible. 01:35:26.990 --> 01:35:39.650 So I was wondering if there's any guidance you could leave for, you could also offer to folks that would want to replicate CYPR's work around how to at least be thinking through making sure that the work that you're doing is accessible for the broadest breadth of your community as possible. 01:35:40.170 --> 01:35:41.450 Yeah, totally. 01:35:41.530 --> 01:35:44.570 I think that, um, I guess I'll say two things about that. 01:35:44.570 --> 01:35:48.770 And then just one thing sort of in response to what other people have said, kind of agree with them. 01:35:48.770 --> 01:36:04.690 I think that if there's two things that help and are important to making something accessible, it's first, don't feel blocked into or limited to trying to teach something in one way. 01:36:04.690 --> 01:36:10.510 I think that there's like a variety of different ways to teach a specific topic. 01:36:10.790 --> 01:36:14.410 And you know, a way that works for some people might not work for other people. 01:36:14.410 --> 01:36:15.350 So it's okay. 01:36:15.350 --> 01:36:24.810 And I think even preferable to have like a variety of different approaches that somebody can take to understand the material. 01:36:24.810 --> 01:36:27.330 I'd say that's the first thing in making it accessible. 01:36:27.510 --> 01:36:37.990 And I think the second thing is to listen to the people that you're trying to communicate with as you're putting together a presentation or even just organizing your thoughts. 01:36:38.030 --> 01:36:47.570 Because I think that sort of checking in with your hopeful audience, before you start to put something together, it's just going to be huge. 01:36:47.570 --> 01:36:49.210 Because everybody's got an opinion. 01:36:49.210 --> 01:36:52.370 I mean, I guess I'm from Brooklyn, so everybody really does have an opinion. 01:36:52.370 --> 01:36:54.130 But only ours count, though. 01:36:54.130 --> 01:37:00.010 At least here, everybody's going to tell you exactly what they're thinking at all moments of the day or night. 01:37:00.010 --> 01:37:08.490 So it's like, you know, if you just check in with people before you go away and put something together, often, you know, they'll tell you exactly what they need. 01:37:08.490 --> 01:37:12.890 And that's why sort of community building beforehand is so important. 01:37:12.890 --> 01:37:23.530 I think the only other thing I wanted to quickly say was, I think that, you know, for people who want to set up EFA organizations, the great thing about the EFA is that it's all over the place. 01:37:23.530 --> 01:37:35.210 So, you know, I think that one of the great things to ask yourself is, you know, how is security or privacy relevant to me in Brooklyn, in Spokane, in Baltimore, in Philadelphia, in St. 01:37:35.210 --> 01:37:35.890 Louis? 01:37:35.890 --> 01:37:40.550 You know, how can it grow out of your local community, your city or town? 01:37:40.550 --> 01:37:48.170 And I think that will always, you know, be hugely helpful both to yourself and to the community in general. 01:37:48.830 --> 01:37:49.230 Absolutely. 01:37:49.230 --> 01:37:50.870 I can't thank you all enough. 01:37:50.870 --> 01:37:57.650 This has been this has been excellent and unsurprisingly, I know you all well enough to know that that's what it would be. 01:37:57.650 --> 01:38:06.010 And so I really want to thank you for the work that you're doing and remind folks that, you know, there's everyone that's on here is amazing, but also like they are amazing because they did the work. 01:38:06.010 --> 01:38:08.450 They showed up and they and they work with folks in their community. 01:38:08.610 --> 01:38:21.730 And you can also be providing that kind of support and engaging your community and that you are the expert in the needs of your particular community from the perspective that you're able to see it and understanding, you know, that you can work with other folks that have different perspectives on your community. 01:38:21.730 --> 01:38:30.690 And that there's a number of folks, all the folks that are here today, as well as the rest of the folks that you'll find at EFF.org slash fight that are part of Electronic Frontier Alliance associated groups. 01:38:30.690 --> 01:38:38.270 So reach out to us email organizing at EFF.org reach out to all you'll find links on that website to all of the groups that are in the alliance. 01:38:38.270 --> 01:38:52.830 And so there's folks here that really like inspired you and you want to be able to replicate their work, you can either reach out to organizing at EFF.org and we'll try to put you in touch, or go to the website and their links are there and you can contact them through the avenues that are available there as well. 01:38:52.870 --> 01:38:55.390 So yeah, and thanks again, everybody DEF CON. 01:38:55.390 --> 01:38:56.550 This has been amazing. 01:38:56.550 --> 01:39:03.470 Thanks again to Curt and Eva and Alexis and Hannah and Rory, of course, and just everyone have a good night. 01:39:03.650 --> 01:39:10.750 You know, go out and you know, whatever your whatever, however you unwind, take advantage of it and just keep continuing to love and take care of each other. 01:39:10.750 --> 01:39:11.190 All right. 01:39:11.190 --> 01:39:12.190 Thanks, everybody.