This is Abortion Access in the Age of Digital Surveillance with folks from the Electronic
Frontier Foundation and the Digital Defense Fund. I am Corinne McSherry. I'm the legal director at
EFF. With me, I have India McKinney, who's director of federal affairs. We have Dahlia
Barnett, a staff technologist, an all-around awesome smart tech person who also works with
hacking hustling, who you may also be familiar with. And then we have Dahlia Barnett from
the Digital Defense Fund.
Kate Bertosch.
What did I say?
Oh my gosh.
Is it my name?
Always!
Sorry, Kate Bertosch.
Don't worry, I'll catch up.
So the way we're going to do this is that we're going to sort of just take turns talking
a little bit about some of what's going on in the year since the Dobbs decision that
if you're here, I'm assuming you're familiar with.
and some of what we are all respectively trying to do about it and especially what you can do and
it is not just the decision as such that is what it is but the Dobbs decision one of the things
that it's made many many people aware of is that their privacy and their security is not where it
needs to be if they want to protect themselves and their communities because we know this is a
this is the team sport and so that's something that EFF and DDF has been have been working on
for years the the privacy and security part of it but we have a whole new and a particularly
dangerous and fraught context with within which to do our work so that is the place that we're
going to be focusing here you know the beginning premise is that
first of all there are lots of different ways in which your digital security might be able to be
compromised if you don't protect yourself but also that there's many many companies third parties
that are collecting data about you all the time often without your knowledge though nominally with
your consent and and that data becomes a treasure trove of information for law enforcement and so
far many companies are not doing enough
to have better practices around that so and in in a current context where that can ultimately be
evidence that could be used against you or your friends or your family or your provider you know
this is a becoming a very very pressing issue for many many people and especially you know and we've
been very involved in trying to do something about it at EFF so I'm going to talk a little
bit about what we've done from the sort of legal team perspective
and then we're going to talk a little bit about what some of the technologists have been doing
which is really really crucial work and then to close this out India is going to talk a little
bit about what's happening at the federal level and there's some really really important work
that's happening right now that all of you should be paying attention to some of which
doesn't seem obviously relevant to abortion access but in fact completely is so I'll be as brief as
possible at EFF there's a few different things that we've been doing from a litigation perspective
one thing we've been doing is we're using the freedom of Information Act to find out at least
in California where we have some decent privacy and data Sanctuary laws to find out where and
how law enforcement is despite those laws collecting automated license plate reader data
about people and then sharing it with law enforcement agencies in states that actively
restrict abortion in a much more serious way than California does
that's unlawful under California law and we are holding them accountable for it
um and then there's sort of some things that are in process there's a lot of work that we've been
doing around what's called Dragnet surveillance and that is where law enforcement gets what are
called geofence warrants or keyword warrants and that's seeking information within a given area or
related to searches with a particular using a particular keyword and this has been a long-standing
work and it doesn't just apply to seeking information about abortion but um this practice is you know
a natural one to apply in the abortion context and so um the we sort of view is like when you
are when you protect privacy and security for everyone you're protecting um particularly in
this moment um the use of those kinds of warrants to um against women and people are providing access
so there's challenges in multiple states um to those warrants and so far they're reasonably
successful because courts are understanding that these are too broad to comply with the
fourth amendment so that is that's so progress is being made so far um then finally just from
the litigation perspective there um we're looking at challenges to social media laws that that
Target teenagers so there's this is at the state level there are already multiple states that have
those kinds of laws and they're supposed to protect the children but they include
things like well you if you're under a certain age you can't access social
media without your parents consent and we know that precisely the people who
are going to most need to be able to access those resources without their
parents consent right are gonna be the ones who are going to get stuck in the
middle so and so we worry a lot about the effect of that for people who are
seeking reproductive health care and gender affirming care we're also doing a
bunch on the legislative side most of that I'm gonna leave to India to discuss
but we have been working in multiple states to get data sanctuary laws passed
to and laws that also just generally limit again that dragnet surveillance
that I was talking about it can be that this is an area where we still have big
fights to do at the federal level but at the state level especially in blue
states there's a lot of very freaked out
upset people and rightly so and so we are able to sort of galvanize like some
energy around this issue and to get some laws in place at the state level it's
not a complete solution but progress is being made really fast in just a year
okay so I can give lots of details later in the Q&A but another thing that
EFF has been doing is we've been doing a ton of activism around things that
companies and nonprofits
even
should be doing around collecting and retaining data about people who reach
out to them there's a lot of practices that really are just creating treasure
troves of data and they do they people don't always realize that that is what
they were doing until the cops come knocking so that's a small sample of
what we're doing the last thing I would point to is we our technologists have
been just going flat out from day one and even before building and building on
tools that you can use to protect your
privacy and your security and we've also been doing a ton of work around
education and I will hand it off to gaining to talk about that sure thanks
so on the tech angle I'm most interested in disarming surveillance
technologies that are endangering the movement and otherwise empowering and
educating people involved in the abortion access work with the ability to
keep good OPSEC while maintaining community trust because it's a little
bit different than most info sack things so at EFF we always work closely with
We jumped on this only a few months before the Dobbs decision really passed, like when the memo leak dropped.
And we have this project called Surveillance Self-Defense, which is at ssd.eff.org.
It's a bunch of instructional guides on tactics and technologies for thwarting surveillance and boosting privacy.
So we have these sort of pre-baked personas in there, where we curate different guides from within the SSD
into an intentional list with the threat models that are likely associated with that persona in mind.
So it seemed like a good place to start, right?
And I've worked with Kate for long before all this stuff came to pass.
So I knew that she was the expert to reach out to, because she's the founder of Digital Defense Fund.
I'll let her speak more about that, but they're fucking awesome.
And so after some conversation, we honed in on three personas, or threat models, that we wanted to tailor our advice to.
And we did.
Activists, healthcare workers, and patients in the healthcare system who are seeking abortion or other reproductive care.
So for the activist, the inherent tension there is this between privacy and publicity that needs to be reckoned with, right?
That needs to be really kind of juggled carefully.
So we leaned towards advising use of compartmentalization techniques
to keep strong separation between what needs to be broadcast really loudly
and what needs to be kept really private.
And then for healthcare workers, it's tricky.
Because there's this huge regulatory standard, HIPAA, which is widely misunderstood.
And it's supposed to provide a cloak of protection for the data that's being passed around in this space.
So there's a bit of compartmentalization techniques.
But I think what was most useful for us is the compartmentalization between the professional and the private, right?
For these people.
And also, being able to effectively communicate a bit of know-your-rights info to the patients that are coming into their spaces.
And then, of course, for the third persona, the people that are seeking an abortion,
or just the allies that are taking them to and from clinics,
there's a focus on not just doing basic things like good internet privacy and secure communications,
but also considering the street-level surveillance that they may face along the way.
Because it's not unreasonable
to expect the ALPRs that will be planted outside of clinics will be facing them,
surveillance cams, and the like.
So honing in on these three personas helped us not just to deliver some really solid advice,
but it helped us be really intentional with our language moving forward.
In blog posts and the one-on-one sort of consultations we were giving individuals throughout the space.
Some of the TTPs that we recommend, either in the blog post or through the abortion access playlist,
again, on the Surveillance Self-Defense Project,
are secure comms, safely attending protests, mobile device security, compartmentalization,
assigning team roles for trusted community members, especially when setting up incident response plans.
That's a little bit irregular from most InfoSec advice you find.
It's a little more activist-oriented.
And, of course, threat modeling.
So although some folks organizing in the abortion access space or the movement
have been operating under the assumption of criminal liability for a while now, before Dobbs,
that aspect is still really quite new for a lot of people.
And it's really scary.
So I think we've only seen the tip of digital evidence being used in courts, right?
At least in the post-Dobbs context.
I should say that last year the FBI reported a tenfold increase
in designating abortion activist groups as terrorist organizations.
So it's been time for us to,
to regard our threat models in that way, right?
What's making things worse is the role that tech companies are playing in this space, I think.
Yeah, like data retention policies need to be reevaluated.
The data collection, aggregation, and brokering industries
are these vampiric, awful scourges that need to be banished like yesterday.
But when tech companies themselves are misunderstanding their own liabilities under HIPAA,
extended through these business associate agreements,
we get these like special third-party SaaS apps
that are kind of positioned to be these messaging services
between healthcare providers and patients.
These sort of necessary components.
And they're running willy-nilly with behavioral tracking and selling that data.
And HIPAA regulation or not, this is just illustrative
of how tracking, the tracking industry at large,
run amok, endangers everyone.
Especially when the lens of criminality extends or shifts
to encompass new people.
So, I mean, take my analysis there with a grain of salt
because I'm not a lawyer,
but I can tell when something sucks
and when it's hurting people.
So we can't just be forming our digital security advice
for activists who are pushing for normalization of abortion as healthcare.
There are also those who are organizing on behalf of communities.
There are those that are handling vast amounts of data
for many others across state lines.
Unlike typical InfoSec paradigms
that are pushing this sort of zero trust as a core ethos,
I think it's really critical
that we re-humanize the privacy and security recommendations
and make them for people that are living among people.
We're protecting human networks, right?
Not corporate ones.
So in that process, we must realize that everyone's security
is imbricated with one another.
Like Corinne said, it's a team sport.
And I should say that one glimmer of hope that I see,
especially in the work that I'm doing with Kate,
is cross-movement organizing
with similar goals of bodily autonomy.
So there's sex worker rights, trans rights, disability justice,
harm reduction activists.
These people are kind of recognizing the shared threat models
and goals of each other,
and therefore sharing resources and upskilling each other
for that sort of collective liberation.
So finally, I just want to say
that my call of action to you guys,
the hackers and security researchers and fellow technologists,
we need to be doing our part
to better educate each other about good OPSEC procedures.
But we need to normalize the use of techniques,
normalize the use of privacy technologies,
so that less tech-savvy folks can use them better,
use them well, and not feel weird for using them.
Any way that we can use our skills
to protect these vulnerable networks of people,
rather than companies, is good.
And I should say, if you're working at a company,
if you're working at a tech company
with bad privacy policies
or a bad reputation of handing over data
to law enforcement
or just, like, weird, creepy tracking stuff,
do your part.
Like, change it from the inside.
And I'll hand it over to Kate.
Cool.
All right.
I always think I do a little better holding it.
I love that we kind of exited a little bit on feeling weird,
because I think it's, like, good to kind of put back in context
sort of why you're listening to a talk today
about abortion access at a place like DEF CON.
I just actually wanted to start with a little question
for the audience, so please don't be shy.
How many people here, this is your first DEF CON?
Give me a little bit of a hand.
I love it. Yay!
So six years ago, it was my first DEF CON.
And I had just two weeks prior got a job
at the Digital Defense Fund
where I had to set up this fund
where our job is to basically provide
digital security and technology resources
to the abortion access movement.
And that includes organizations working on behalf of patients,
providers, and then now, more recently,
kind of interfacing directly with those groups
that support patients themselves.
So I think one of the really strange things
about being at DEF CON was, like,
do I belong here? What am I here to learn?
And then no sooner do I do that
than the very first year I was here,
I walked into a panel with EFF wonder Cooper Quinton
and journalist Kashmir Hill
talking about the pregnancy panopticon
and all of the different types of places
that pregnancy and related data is kept
and the leaks in applications and things like that.
And it was just such a really wonderful eye-opening moment
in the years since.
I think I've really enjoyed getting to work more
with the cryptography and privacy village.
I'm now one of the core organizers,
so come visit us out there as well.
But I think it was kind of through being in this space
that I absorbed a lot of what I think makes DEF CON
a really great place to figure out, like,
sort of what's next for this kind of very big
existential crisis, which, like, DEF CON is,
I took back from these different years with me
that sort of, like, spirit of irreverence,
that, like, anyone can learn anything,
that all of us don't have to accept the structures
and hierarchies of technologies as they are handed to us.
You have the right to rip the do not remove sticker off.
And I think that's something that I think
I've tried to take back with us
so we and our team can kind of better understand
not just the threats in our space,
but how we can be flexible and creative
and brave and adapt to them.
So these days, our work mostly centers on ensuring
that organizations that work directly with people
who are seeking abortions are prepared,
that they can utilize their own creativity
and tools to build the ones they do not have,
to reuse tools for unintended
but very amazing values-forward purposes.
I think in this way, sort of, DEF CON really embodies
that same spirit of what autonomy actually means.
And it's why I'm really excited to come back
and bring back to you this session sort of, like,
how we together can continue to take that entitlement
that we all have to sort of make technology
and spaces and our digital selves our own.
I think if you take kind of nothing back
with you today, except for a couple of key points,
it's that over these last few years
as we've worked directly with these organizations,
we've kind of figured out, out of all of these threats,
you know, because certainly here at DEF CON,
we love a good threat model,
what is it like right now for somebody seeking abortion?
What are the issues that people are really
kind of facing off with?
And we know these things actually because,
unfortunately, even before the Dobbs decision
overturning Roe v. Wade,
people have been getting prosecuted for being suspected
of ending their own pregnancies for many decades.
And so there are organizations,
like legal organization If, When, How,
who've compiled reports of every single time
that this has so far happened in the United States
that we can tell.
It can be sometimes very difficult to find.
And they found these sort of very key disturbing results,
which is that as we kind of look through these cases,
the sort of entry point where the case of somebody
who is suspected of ending their own pregnancy
comes to the attention of law enforcement,
it is usually primarily through either A,
people who are responsible for their care,
be it doctors, nurses, social workers,
someone else who's supposed to be providing them
with personal health care or other support,
or someone that the patient knows.
So friends, exes, neighbors.
And that is a vast majority of the cases.
So that is extremely disturbing.
I think very notable also that cases don't tend to come
to the attention of law enforcement
via these like dragnet methods.
We know that like data is generated
all throughout a person's experience
of being pregnant and deciding whether or not
they want to continue to be pregnant.
But that tip of the spear is unfortunately
an interpersonal violation, somebody turning you in.
And then all of the data that's generated
about that experience becomes relevant
and is often requested by law enforcement
or as we unfortunately see quite a lot,
there is something called a consent search
that is a disproportionate factor in many of these cases.
That is where someone is typically pressured
into disclosing a device or agreeing
to the search of a device.
Then we know a lot of those same
forensic digital technologies that the folks
on this stage are all experts in come into play.
They plug your phone into a device that clones the drive
and then they search for everything that's on it.
They use keywords, they're looking for everything
from text messages, email receipts,
your search information.
Often it's not even necessary then to go to the company
in question because that search history copy
is right on your phone.
So I think with this in mind, it's very tempting sometimes
to be like, oh, well, if I had to go
and get an abortion, I would do all of these things.
I would use Signal, use Tor, use Bitcoin, I don't know.
It's very tempting for us to each construct in our minds
what I've come to call the ghost abortion,
the abortion that has no data.
I've literally had a reply guy tell me that in order
to get your legally sensitive abortion,
first you have to jailbreak your Kia Sorento
to not collect that GPS data along your route to a clinic.
As I think from, you seem like a sensible crowd with that laugh.
So you can kind of see how like as many good intention things
as we may want to put out there to help folks to learn
about how to better protect themselves
and the people they're supporting,
there is only so far that we can ask of people.
Like it's really not reasonable to ask someone
who's probably going to have to search across many states,
often great distances, make a lot of travel plans now
and spend way more money than they've ever had to spend
on getting an abortion.
I mean, like we forget all the time, right?
That like we talk about all these various pieces of data
that are collected through search engines
or through our experience of interacting
with a mobile device, but banking institutions
and telecoms companies have a long history,
as you have heard in this building before,
of unfortunately sharing data with law enforcement.
So I think one of the things that's very critical
for us to do then is to look at cases that we see in the news.
Like you may have seen that one where unfortunately
Facebook messages were sort of front and center
in a very sensitive case
of a parent and child trying to work out
how to obtain an abortion, allegedly.
I think what's very unfortunate about that
is that those messages are things that were,
they were a source of support.
They were people in the same household
trying to give each other the sort of attention and care
that that kind of situation deserves.
And that that is used against you in a court of law
is a huge violation.
So I think what was really, really great to see
from communities like this one was the outrage
that companies like Meta have a standard practice
of not maintaining encryption for those communications.
I think we all have an idea here of why
we sort of have the ability to use other things
like we do as part of our work,
try to encourage folks to use encrypted chat
to understand the value of it.
But that encryption should be by default.
And that's why I'm so grateful for the work
of the other folks on this stage is because
it should not be on one person to not make human mistakes
in the course of something so extremely normal and needed.
And part of the human experience as getting an abortion.
So I think like that is something I really want you
to take with me just because I love the vibe in DEF CON
where it's like technology works this way,
but I think it should work this way.
And I'm going to roll up my sleeves and do it myself.
And I just absolutely love that.
I think I've really taken from this that, you know,
we all have this sort of like digital body
that law enforcement has chosen to go after.
Those messages on Meta were really critical for the case
because physical bodies, especially pregnant ones,
do not cooperate with criminal forensic standards.
It is a very noncompliant experience.
There is no drug test for an abortion medication.
So generally speaking, in order to form a case
based around an experience that many people have,
which is that pregnancies begin and pregnancies end,
they have to use this digital body and the corpus of data
that it's created and try to construct sort of your intention
of the inside of your own head.
All of that is a tremendous violation,
and they're going to keep utilizing,
as other folks have described,
pregnancy as sort of the good enough reason
to violate your Fourth and Fifth Amendment rights
and break down encryption, privacy,
and other technology rights across the board.
So I'm really, really grateful to work in community
with all these folks and pass it back
because I know that was just a whole lot to absorb.
But I know that I'm really, really grateful as well
for this community and your collective continued enthusiasm
to make sure that we have the right not only
to support our own communities,
to support ourselves and learn those skills,
but also to change the environment that they operate in.
And yeah, with that, I wanted to pass it back
to the EFF crew and Sandhya.
Thank you.
Yeah, so you've heard from both Kate and Daley
some of the things that you can do individually
to protect your own individual privacy
and to shore up your own individual security.
And the thing is, that's a lot,
and that's a lot of a burden to put on you right now.
And it's particularly a big burden to put on somebody
who is pregnant when they don't want to be,
or pregnant and something is going wrong,
or just pregnant.
I am currently pregnant.
There's a lot that goes on with just being pregnant
when you don't have to think about,
is my search history going to turn me over to the cops?
And that's not a thing that should happen.
And so that's when we start talking about systemic change.
We need to be making systemic change.
So the thing is, laws can change,
and that cuts both ways.
What we saw before, a lot of times you hear,
like when we do this privacy work,
we hear a lot of people say things like,
well, I have nothing to hide,
so I'm not really concerned all that much about my privacy.
Well, all of a sudden, the Dobbs decision happened,
and people who previously had nothing to hide
because abortion was legal,
all of a sudden, they have something to hide.
If you are a person who is able to bear children,
you probably have something to hide now.
And there's a lot of things that are in your phone
and are in your computer
that can tell on you,
sometimes to law enforcement with a warrant or a subpoena,
sometimes just because law enforcement asks nicely,
sometimes because companies voluntarily turn that information over
because they think you are trafficking children
or something like that.
And so all of a sudden,
we all need to start caring both about
a comprehensive consumer data privacy law,
which does not exist in the United States.
We also need to start thinking more about attacks
on encryption and other ways to have private communications.
So my name is India McKinney.
I'm the Director of Federal Affairs
for the Electronic Frontier Foundation.
And so that's a fancy way of saying I'm a lobbyist.
And so I will tell you that even though
there's been a lot of conversation
in the last couple of years in Congress
about a comprehensive consumer data privacy law,
there is not currently introduced legislation
that would protect the privacy of all Americans.
It currently does not exist.
And so if you think that's a problem,
there's a phone number there.
You need to call that phone number.
You need to ask to speak to your senator.
When they pick up the phone,
you tell them your name,
you tell them your address,
and you tell them you want to see
a comprehensive consumer data privacy law,
and you would like a response.
Then you call that phone number
and you talk to your other senator.
Then you call that phone number
and you talk to that representative.
You have three.
You make three phone calls.
If you don't want to do that,
there's a website up there, act.eff.org.
We don't currently have an action
about a consumer data privacy law
because, again, the law doesn't exist.
What we do have is several different actions
that are targeted against several active,
big, big bills that are not directly targeted
at either abortion access or privacy,
but they are targeted at increasing
the risk of child abuse,
is to give law enforcement
more access to all of your communications.
Carve outs in ECPA,
direct attacks on encryption,
age-gating parts of the internet.
All of these things
are actively being discussed in Congress
as a way to protect children.
If you look at the language
that Congress is using
to talk about child exploitation,
child endangerment,
child trafficking,
and you look at the way pro-life people
talk about abortion,
it's actually the same language.
You talk about child abuse.
you need to be really careful when you're hearing them talk about these bills that are going to save
the children from the terrible things that happen on the internet. Of course, there are terrible
things that happen on the internet. We've all been on the internet. There are terrible things
that happen on the internet. There are terrible things that happen in real life. Encryption is
not the problem. But law enforcement has been extremely clear that they want to be able to
access all of your messages. And they don't want to have to go through your phone to do it. They
want to be able to just get it from the companies. Because again, right now in the status quo,
they can both subpoena the information. They can just ask nicely for the information. And in some
cases, they purchase the information from a data broker because that's legal. They're using your
taxpayer dollars to buy information on you that has been collected by data brokers. So if you
think this is utter nonsense, there's a phone number where you can call and you can tell your
senators that this is utter nonsense. So it works best if you have a specific thing that you want
them to do. I want you to apply. I want you to apply. I want you to apply. I want you to apply.
I want you to oppose the EARN IT Act. I want you to oppose COSA. I want you to oppose the Stop CSAM
Act. I want you to oppose the Cooper Davis Act. Those are all the ones on act.eff.org. If you
don't want to talk on the phone, just push some buttons. You can do it on your phone right now.
And so the thing is, those are the things that really actually matter to change the discussion
about making systemic changes. Right now, the reason there is no comprehensive consumer data
privacy law is because they try to change the system. Right now, the reason there is no
comprehensive consumer data privacy law is because they try to change the system. Right now,
And it turns out, it's really, really hard to get right. The law that was proposed, the ADPPA,
and I don't remember what that stands for anymore, it was a good starting point, but there
were a lot of holes in it that were not strong enough. And the biggest one is it was going to
preempt any state laws for providing additional protections for their consumers in the individual
states. So it was going to be a lower threshold, and states weren't allowed to build on top of that,
which again, if you think that's utter nonsense, I have a phone number for you.
So, but then Congress, we had elections, there's a new majority in the House of Representatives.
The Senate has decided, has openly said in multiple meetings, they are not interested
in taking up consumer privacy for everyone.
They're really more focused on helping the children.
And the House of Representatives, they've had hearings about a consumer data privacy
law for everyone, but no text has been introduced because it's really hard.
They got a lot of bad press.
They got a lot of bad emails.
And they just haven't done anything about that.
And so until there's the political will, until there's political consequences, because people
like you create it, that's actually not going to change.
So it's a little bit like, again, I am a political person, not a computer person, so I'm going
to totally butcher this analogy, but bear with me.
We basically want to detest.
Doss this issue.
One person going to make a phone call on this, yes, it doesn't move the needle.
If everyone here at DEFCON makes the phone call, clicks the button, sends the email,
goes to a town hall meeting, and convinces other people to do that as well, that is going
to have a massive, overwhelming impact on how the Congress as a body perceives this
issue.
Right now.
Right now, privacy polls extremely well.
Are you in favor of privacy?
97% of people say yes.
We don't know what the other 3% of people are thinking.
Maybe they're law enforcement.
I don't know.
But it's an overwhelmingly popular issue.
But what does that mean?
What does that look like?
Does it mean a private right of action so that the lovely feisty lawyers at EFF can
bring a class action lawsuit and actually make change?
What does it mean?
So.
So we really want to take your questions and get more into the heart of what this issue
is.
But I do want to make sure that I leave you with the call to action.
There are things that you can do right now.
There are also things that you can do when you get home.
Paying attention to these issues, becoming a member of EFF and signing up for our emails,
and then taking all of the action alerts.
Like this is our day job.
We want to share this with you.
And we actually really do need your help.
And I do actually believe that if we all do this together, we can make a difference.
Thank you.
Thank you.
Thank you.
Thank you.
Thank you.
Thank you.
All right.
So there you have it.
It's the trifecta of strategies.
We're going to have to do them all at the same time.
So now we have 15 minutes and we would love to take questions from the audience.
If you have questions for the technologist, the lobbyist, the litigator, please go up
to the – there's a mic right there in the middle.
And we also, if you would rather ask a question, we'll run it.
Anonymously, we have some paper and pens that you could come across like ninth grade health class
You have a question or two embarrassed to ask in front of everybody
Here, I'll hand these down and we can kind of like leave them someplace
Okay, please go ahead, thank you. I think you're first
Hello
Hi
Thank you very much. Congratulations on your pregnancy
I feel very grateful to live in California where I feel like my rights are more or less intact
What do you all think about period trackers?
Am I being extremely paranoid to not want my daughter to track her period online?
Okay, I think these are really
Great protective instincts. I always love the question about period trackers because when they kind of blew through the news
It was a wonderful opportunity for us to talk again about threat models
Basically like we discussed a little bit before
Some of like that again that really first way that cases come to the attention of law enforcement tends to be like an interpersonal
Piece either health care worker or someone who is close to you violating your privacy
So period trackers are very patently useful when I need to get an abortion
special
if it's very sensitive I need to know how pregnant I am that's gonna like let
me know whether I can use medication abortion which can be done very
discreetly it helps me to know if I'm calling to go out of state where I need
to go in which clinics can help me with my procedure so this is a patently normal
useful thing that we all benefit from so how do I do it safely as of right now
period tracking apps are not tending to be like the way that that sort of
surveillance is is again coming to attention of law enforcement lots of
period trackers have responded to a lot of that concern rightly so and have
disclosed a little bit more about how their different applications work so
there are some that are like Yuki app you ki which are local only to the phone
so they can have that kind of ability to track your period it also has a lot of
great other sexual health information in there that is only then not connected
to the internet all that wonderful stuff other companies like clue have
like posted way more comprehensive disclosures
about how
you can use a period tracker to track your period and how you can use it for
they would respond should they receive any legal info requests and I think
these are all the ideal like I think the sort of questions from the community and
from consumers were excellent and I want us to keep doing that because what
happens is that companies come out of the woodwork who are like actually I
think I feel pretty confident in the way that we handle this particular problem
and I'm excited to share with you that same entitlement and expectation you
should have to it being end-to-end encrypted or working only on my phone or
a combination of the above so I would say that there are safe options to use
for your personal threat model and that it's a great opportunity to explore them
with your daughter and learn together kind of like what's what's most
important to each of you and get to practice it together which is really
cool so thank you for your question hello so first of all I just want to
say thank you so much for what you're doing for the community it means a lot to
me I don't have a question I just have a
comment that I wanted to make with the end-to-end encryption applications that
you guys are recommending folks to use especially with the point that you brought up
with the the cloning of the mobile devices and that being able to be
leveraged against folks trying to get abortions or have so highlighting the
point that end-to-end encryption only happens in transit so once it's
actually on that device if that's clones the whole end-to-end encryption kind of
goes out the window so I just wanted to highlight that for you ladies especially
if you're advocating for our community so thank you yeah that's absolutely true
and so that's actually one of the things that we bring up like I don't want to
always talk about one of the things that we bring up by the end of the day is
you know if we haven't created that information we might be able to just
get it out in the right way we might have a bigger chance of making it
accessible and we might have a bigger chance of getting it out of the way
and I know these days it's just very rare for people to have that ability to
use it but I think it's really important that we bring it out there on here so
that you know we all know in our communities that what happens is if
someone has his or her own lights and doesn't have an army and doesn't have
somebody in their school to make sure that they have the access to that
information we don't want to do that for them
messages without having to break encryption. That's a thing that cuts both ways. But when law
enforcement rings their hands and says we just can't get any of it, that's actually not true.
Absolutely. Thank you. Hi. I really appreciate what you've done here.
The problem that I can see is that there are a lot of folks that are not in this room.
So my request is could you put together not best practices because best practices generally don't
stay that way or aren't in the beginning. Can you put together some really good practices for now
and make those available in some way that the folks who need this information,
whether it's from a technology, a legislative, or a practice basis, can learn what's the best
way that they can approach this issue that they're trying to deal with. Make it ubiquitous
and make it simple. Cool. Yeah, so we at least had
EFF, we've actually tried to put together a whole bunch of resources in different forms.
So we have the surveillance self-defense work that Daley was talking about. And then there's also,
we've written a lot for other audiences on the blog, like what companies can do now and should
be doing right now if they don't want to be honeypots for law enforcement. That wasn't the
title, but that was the meaning. And so we have tried to do the, to put that, those resources,
together and, but they always have to be updated. There's an issue tag on EFF for reproductive
justice. So you can go there to find all of the blogs associated with this topic. And then over
on ssd.eff.org, you can find that playlist for the specific tech advice and general information
security advice we give. Cool. Yeah. Great question. Thanks. Yeah. And I just threw our URL for our guide in case,
digitaldefensephone.org. You can just go right there. Next. Thank you. Yeah. My question is kind
of along the same avenue. I'm from Washington state and I was actually one of the people
that worked really hard to get our My Health, My Data bill passed, which gives us in Washington
state, not just women, but men, all of our health data actually needs to stay private and not trackable.
And of course, when I was advocating for this, so many legislators do not understand
the internet. One person from my own district actually had an amendment to exclude small
businesses from this law. And I was like, so Apple health tracker can now just spin off and
be an LLC. Now it is a small business and it can continue to track your data,
and trade and sell it. So I'm wondering if the EFF has a way to help simplify
what we're asking for, but to also help educate the legislators who are like, oh, that computer
stuff, I just don't understand it. And I'm like, well, that computer stuff, you are making laws
about it. So you should understand it. So there's actually a federal bill in both the House and the
Senate called My Body, My Data, which is a law that would provide privacy protections at
the federal level for reproductive and sexual health data. So again, you can call that phone
number and you can tell your representative to support My Body, My Data in whatever chamber
they're in. And you can also, that since the bill exists, you can share it with your local
state people and say, this is the law. Start here. Don't give us less than this.
Right. And do you want to add anything to that?
One thing, a lot of people in Washington state, the legislators were saying,
oh, they can't just do this for Washington state and not the other 49 states. And my husband's
like, well, we do it for the European Union. So already, even though we have this bill,
My Health, My Data, it is not equal to the privacy the EU has, and it's not even perfect there.
But that's good to know. I just want you to know legislators are like, explain.
Yeah. What exactly does this mean? Yeah.
So we have seen that before, but, and there's a lot of education that always has to be done.
But two things I would say is that one thing is I actually think it is powerful to have protection
for health data for everybody. So we bring it in, right? It's not like men don't also want that,
or people who can't get pregnant don't also want data privacy protections. But the other thing I
would say is you should never hesitate to start in your state. The only reason there was any
discussion right now about, or there was last year, I don't know, I don't know, I don't know,
a real federal bill is because California passed a really strong privacy bill. It wasn't perfect,
but it was very strong. And all of a sudden, a lot of tech companies are like, wait, what?
No, no, we don't want to have to comply with 50 different state bills. And then you can say,
okay, fine. Good. Let's have a federal bill, but let's have it be strong and not weaker than
California's. Yeah. Great. I believe Washington state bill is actually stronger than California's.
Real quick, did we have any sheets to come back? Anybody have any anonymous questions?
Anonymous questions. No? All right. That's okay. Next question.
Thanks. Thanks for sharing your ideas on this space. I feel like I just opened my eyes.
Can you be louder? Sorry. I feel like I just opened my eyes to this topic.
I couldn't quite understand your definition of autonomy.
Yeah. Can you repeat that? And secondly, you said DefCon nurtures autonomy.
Can you connect the idea again for me? I'd love to come back to that.
Yeah. I think honestly one of the things that, and this is very personal, this is not like a dictionary definition of autonomy,
but I really enjoyed how when I came to DefCon, there was sort of this idea that
a piece of technology is given to you. We have these materials, computers, we have systems,
we have how we interact with other people, and you sort of have that.
You have the right to kind of like make them your own, like a prism through which you get to act out
what you will and your perspective on the world. And I just really felt very inspired by that.
I think it's really wonderful to get to walk into any village and try something for yourself
and to direct your own learning and to just have that sort of spirit that all of this is for you
and for you to express yourself here. So I think like, you know, I don't know,
I think my ideas about autonomy are like changing all the time. I think all of us who like work in this space,
we sort of have these aha moments where you're like, wow, I see parts of how the world fits together.
And it's really, really remarkable. So I think this is one of the many places that happens for me.
I don't know if anybody else on this table wants to speak to what autonomy means to you as a technologist.
No? All right.
I couldn't say it better.
Hi there. So I'm trans, so thank you for acknowledging the intersectionality between trans rights and abortion rights
and all of the other things. One thing I just wanted to ask, what would you advise people
who say they're in the middle of having an abortion or getting their kid gender affirming health care,
something like that, and they may suspect that they've started to become a target of an investigation or something
or if their state has changed their rules, how would you advise those people to handle that?
Because, of course, it's not the crime, it's the cover up.
And, you know, how do they deal with that?
How do they deal with the potential evidence that might be within their devices and their information?
Can I start? Oh, please, go right ahead.
I would start with the non-technical stuff first because it's the easiest to approach for people.
It's a lot less scary. Pen and paper exercises are great.
So, like, device mapping and network mapping, I mean, like, social network mapping
is usually a really accessible point for people because they can identify the people that they have already given trust to.
And then they will begin to formulate how to speak with those people about this new concern they have
and loop them in in the process and make it, again, a team sport.
That's huge, right?
I would also then from there begin to develop some secure communications methods
with those people they've identified that already have that trust.
And I mean secure communications in the non-technical way first, right?
And you could maybe come up with some careful language or some rules, some community standards
about how to broach the topic and how to broach it in different contexts
when in different contexts, if that makes sense.
You can get really tricky with it if you want to do, like, linguistic steganography
or if you're, like, a history nerd, Polari-type, like, code switching of language.
But that's usually, like, really accessible for folks.
And it also introduces some really fundamental infosec or privacy concepts
that translate quite nicely to the technologies
they'll eventually use.
That they'll eventually want to start incorporating,
like encryption technologies or good backup games or et cetera.
Thank you.
Thanks for the question.
I think we have time for one or two more.
Hello.
Hello.
My question is more about civic engagement.
I live in a really strong...
Can you speak louder?
The speakers all face that way.
Yeah, that's a problem.
Oh, okay.
My question is more about civic engagement.
I live in a really majority strong district
where I have unresponsive congressional representatives.
And so my question is, is it a framing issue?
How do you approach people whose viewpoints just are way different
and what can I do as a constituent in those, like, areas to make it more effective?
Because I've called and I get form responses
and they don't really seem to want to engage with a voter
who's a minority in their district with regards to, like, political affiliations and so on.
Yeah.
So the thing is abortion is obviously a super polarizing political issue.
But a lot of the things that go into protecting abortion rights are not.
There's a lot of reasons that you are interested in protecting individual privacy
that have nothing to do with abortion.
There's a lot of reasons that you want to protect the ability
to have a private conversation digitally that have nothing to do with abortion.
And so this is really a nonpartisan issue.
Encryption is supported by members of both parties in Congress.
Encryption is also being attacked by members of both parties in Congress.
It's really nonpartisan.
So there is a little bit of code switching depending on which office you're going to talk to.
But giving the government the ability to read all of your messages
just because they feel like it or for funsies,
like, that rightly terrifies a whole lot of people across the political spectrum.
So it doesn't really matter if you're talking to a Progressive Caucus member
or a Freedom Caucus member.
That's something that is scary.
And so if you protect some of the tools,
you end up protecting the rights of people.
People who need it for different reasons.
Thank you.
Great question.
So I went to both of the websites.
And this is a challenge I put to both groups.
And I've been involved in political action before.
So I talked from some area of expertise.
What's missing from both websites is a pamphlet,
a set of directions,
Q&A about how to talk to the Uncle Bob
who does not understand the word encryption.
And his version of privacy is drawing the blinds on the window.
And that's privacy to him.
So the thing is that on both of your websites,
it is call to action to go call a Congress critter,
which is fine,
or a state representative, which is fine.
But there's nothing there on either one of your websites,
as far as I can tell,
and I looked at both URLs,
that say how to persuade members of your family.
And I can tell you that I've worked on local issues
and gotten local issues passed.
That was the way that we got our issues passed
when we were going up against big, big dollars.
The California Realtor Association.
So the thing is,
is if you can't give somebody how to talk to the Uncle Bob,
and they can't persuade Uncle Bob,
I found that the people who are budding activists
pull back into their shell,
they lose confidence to make that phone call
to their Congress critter.
So that's what I'm calling out both groups on,
is that you were worried about talking to Uncle Bob,
Congress critter, but not Uncle Bob.
Please do the Uncle Bob persuasion.
Thank you.
Thank you.
Okay.
Thanks so much.
We'll make this our last one.
Thank you.
Hi, just a question and a comment
related to some of what's being said.
So I currently live in the political hellscape
and abortion hellscape that is Texas.
And so I'm worried about my daughter,
her friends, et cetera.
And I think a lot of it comes down
to just simple narrative, simple stories,
the ability to hand over some,
again pamphlet was used as a term,
but use this technology.
Don't use that technology.
Use this method of travel.
Don't use this method of travel.
What is the simple guides
that you can hand to somebody that is,
here's the 10 things to think about.
I think that's critical in my opinion.
Great.
I totally agree with you.
And I think this is a wonderful note to close out on
because I get to connect you
to some other amazing resources.
All of the groups that have operated in Texas
and other states that are now banned states to date
have taken on this work.
I mean, frankly, how we learned how to do it
at Digital Defense Fund is by seeing
how they connect directly with patients
and we work together to translate
some of this advice into something
that's reasonable for someone
who is going through the experience right now.
So I would say that organizations
like Jane's Due Process have amazing content
directed at teens that is absolutely there
to not only help you know what your rights are,
to help with accurate information,
but also each of them is their own amazing
digital security expert in the field
knowing what folks deal with.
So I'm so glad that like you are there
supporting your daughter and all of her peers
because now there are all these amazing organizations
that can support all of you as a family and community.
So thank you so much for sharing that.
I really appreciate it.
Thank you for what you're doing.
It's critical.
All right.
Thank you all so much for coming.
I just want to flag that a very kind person
gave us a few boxes of Plan B
and informational packets.
They're right here.
There's just a few,
but perhaps you or a friend
would like to have one on hand.
If so, come and grab it.
Yeah, come grab some.
Plan B.
These are real like,
I give these out at every event we're at
and if there's always a huge hit,
pack them with some sour gummy candies
and people really go nuts.
So.
All right.
Thanks for being here.
I have some stickers.
Thanks for coming.