[Applause]
thank you very much hi so uh there's a
little formality first as a member a
good standing of the uh order of uh
after dinner and Conference speakers of
England and Wales uh I am required as
the last speaker before lunch to make a
joke about being the last speaker before
lunch this is that joke thank
you so uh I work for Electronic Frontier
Foundation and um I met some of you in
the Halls here and when I mention I work
with e f they say oh you guys have been
around for a long time and it's true
like not just internet time not like
this is Zach's second birthday so we're
the daughtering old men of
cryptocurrency long time like we've been
around for a quarter Century a
legitimate long time and I want to talk
about our origin story about the the key
victories that we scored really early on
a quarter century ago that really are
the reason you guys and you folks are
are in this room today um I want to talk
about the crypto world s uh not those
crypto
Wars these crypto Wars um so back in the
late 90s the uh NSA classed cryptography
as ammunition and imposed uh strict
limits on civilian access to strong
crypto and there were people as you
heard Prima speak about who called
themselves Cipher punks uh crypto
anarchists who said that this was bad
policy it was a governmental overreach
and it needed to be changed and they
tried a whole bunch of different uh
tactics to try and convince the
government that this policy was not good
policy so they talked about how it was
ineffective right they said you can ban
civilian access to strong cryptography
uh and only allow um access to uh to
weak crypto the the 50- bit version of
Dez um and that will not be sufficient
to protect people um they they made this
as a technical argument they said like
look we believe that you could brute for
uh Dez with consumer equipment and uh
the court said well who are we going to
believe you or the NSA because the NSA
they hire all the PHD mathematicians
that graduate from the big 10 schools
and they tell us that Dez 50 is good
enough for anyone so why should we
believe you and so we did this we built
this thing called the Dez cracker it's
quar million dollar specialized piece of
equipment that could crack the entire
key space of Dez in 2 hours right so we
said look here's your technical proof we
can blow through the security that
you're proposing to lock down the entire
US Financial political legal and
personal systems with for a quar million
dollars uh and they said well maybe
that's true but we can't afford to have
the criminals go dark right they're
going to hide behind uh crypto and they
won't be able to uh we won't be able to
spy on them so in the face of all those
uh of all that resistance we finally
came up with a winning argument um we
went to court on behalf of a guy named
Daniel J Bernstein uh you've probably
heard of djb he's a cryptographer he's a
cryptographer whose name is all over all
the ciphers you use now but back then
djb was a grad student at the University
of California at Berkeley and he had
written a cipher uh that was stronger
than Dez 50 and he was posting it to
uset uh and we went to the ninth circuit
and we said we believe that the first am
of the US Constitution which guarantees
the right to free speech protects djb's
right to publish source code that code
is a form of expressive speech as we
understand under uh uh expressive speech
in the US constitutional framework and
this worked right making technical
arguments didn't work making economic
arguments didn't work making law
enforcement arguments didn't work
recourse to the Constitution worked we
won in the ninth circuit we won at the
appell division and the reason you folks
can do ciphers that are stronger than
Dez 50 which these days you can break
with a Raspberry Pi the reason you can
do that is because we won this
case thank
you so I'm not saying that to suck up to
you right I I'm saying that because it's
an important note in terms of tactical
diversity in trying to achieve strategic
goals right it turns out that making
recourse to the Constitution is a really
important tactical uh era to have in
your quiver and it's not that the
constitution is perfect and it's
certainly not true that the US always
upholds the Constitution right um all
countries fall short of their goals the
goals that the US fall short of are
better than the go goals that many other
countries fall short of the US still
falls short of those goals and the
Constitution is not perfect and and you
folks you might be more comfortable
thinking about uh deploying uh math and
code as your tactic but I want to talk
to you about the full Suite tactics that
we use to affect change in the world and
this is a framework that we owe to this
guy Lawrence leig uh Larry uh is the
founder of Creative Commons and has done
a lot of other important stuff with
Cyber Law and now works on corruption
that's a connection I'm going to come
back to and and Larry says that there
are four forces that regulate our world
four tactical Avenues we can pursue
there's a code that's what's technically
possible Right making things like deep
crack uh there's markets what's
profitable right founding businesses
that create stakeholders for uh strong
security turned out to be a really
important piece to continuing to advance
the crypto agenda because there were
people who would show up and argue for
more access to crypto not because they
believed in the US Constitution but
because they're shareholders demanded
that they do that as part of their
ongoing funding right there's Norms
what's socially acceptable moving from
the discussion of crypto as a thing that
exists in the realm of math and policy
and to a thing that is um uh part of of
what makes people uh good people in the
world to convince them that uh for
example allowing sensitive
Communications to go in the clear is a
is a a risk that you put not just on
yourself but on the counterparties to
your communication I mean I think we
will eventually arrive at a place where
sending sensitive data in the clear will
be the kind of technical equivalent of
inviting people to a party where you
close the door and chain smoke right
it's your selfish laziness putting them
at risk um and then there's law what's
legal now the rule of law is absolutely
essential to the creation and
maintenance of good Cipher systems
because there is no keylength there is
no Cipher system that puts you beyond
the reach of law right you can't audit
every motherboard and every server in
the cloud that you rely on for a little
backdoor chip the size of a grain of
rice that's tapped right into the
motherboard uh control system um you
can't make all your friends adopt good
operational security this is uh a bit of
the uh the rules used by the Deep packet
inspection system deployed by the NSA
this was uh published in a German
newspaper by uh uh after it was leaked
to them um the Deep packet inspection
rules that the NSA was using to uh
decide who would get uh long-term
retention of their Communications and
who wouldn't um they involved looking
for people who had ever searched for how
to install tour or tails or cubes so so
if you had ever figured out how to keep
a secret the NSA then started storing
everything you ever sent uh in case you
ever communicated with someone who
wasn't using crypto and through that
conveyed some of the things that was
happening inside your blackbox
conversations right you can't make
everybody you will ever communicate with
use good crypto and so if the state is
willing to exercise illegitimate
Authority you will eventually be found
out by them you can't audit the ciphers
that uh that every piece of your tool
chain uses including pieces that you
don't control that are out of your hands
and in the hands of third parties uh one
of the things we learned from the
Snowden leaks was that the NSA had
sabotaged the random number generator in
a nist standard uh in order to weaken it
so that they could backd door it and
read it and so long as the rule of law
is not being obeyed so long as you have
spy agencies that are unaccountable
running around sabotaging crypto
standards that we have every reason to
believe otherwise are solid and sound
you can never achieve real security um
this turns out to be part of a much
larger thing uh called Bull Run in the
US and EDG Hill in the UK that the NSA
and MI5 were jointly doing to sabotage
the entire crypto tool chain from
Hardware to software to standards to
random number generators opsac is not
going to save you um because security
favors attackers if you want to be
secure from a state you have to be
perfect you don't just have to be
perfect when you're writing code and and
checking it in you have to be perfect
all the time you have to never make a
single mistake not when you're at a
conference that you've traveled across
the ocean to and you're horribly
jetlagged not when your baby has woken
you up at 300 in the morning not when
you're a little bit drunk you have to
make zero mistakes in order for the
state to penetrate your operational
security they have to find one mistake
that you've made and they get to cycle a
new shift in every eight hours to watch
you they get to have someone spell off
the person who's starting to uh get
screen burn in on their eyes and has to
invert the screen because they can no
longer focus on the letters they just
send someone else to sit down at that
console and watch you so your
operational security is not going to
save you over time the probability that
you will make a mistake approaches
one so crypto is not a tool that you can
use to build a parallel uh world of code
that immunizes you from an illegitimate
power ful State Superior technology does
not make inferior laws
irrelevant but technology and in
particular privacy and cryptographic
Technology they're not
useless just because your obsc won't
protect you forever doesn't mean that it
won't protect you for just long enough
crypto and privacy tools they can open a
space in which for a limited time before
you make that first mistake you can be
sheltered from that allseeing eye and in
that space face you can have discussions
that you're not ready to have in public
yet not just discussions where you
reveal that your employer has been
spying on everyone in the world but all
of the discussions that have brought us
to where we are today you know it's
remarkable to think that within our
lifetimes within living memory it was
illegal in much of the world to be gay
and and now most of those territories
gay people can get married it was
illegal to smoke marijuana and now in
the country I'm from Canada marijuana is
legal right in every province of the
country
right um it was illegal to practice uh
so-called interracial marriage right
there are people who are the products of
those marriages who were illegal so how
in our lifetimes did we go from these
regimes where these activities were
prohibited to ones in which they are
embraced and considered normal well it
was because people who had a secret that
they weren't ready to talk about in
public yet could have a space that was
semi-public where they could choose
their allies they could find people who
they thought they could trust with a
secret and they could whisper the true
nature of their hearts to them and they
could recruit them into an Ever growing
Alliance of people who would stand up
for them and their principles they could
whisper the love that dared not speak
its name until they were ready to shout
it from the hills and that's how we got
here if we eliminate privacy and
cryptography if we eliminate the ability
to have these semi-public
conversations we won't arrive at a place
in which uh social progress continues
anyway we'll arrive at a place that will
be much like the hundreds of years that
preceded the legalization of these
activities that are now considered
normal where people that you love went
to their graves with secrets in their
hearts that they never confessed to you
great aches that you had unknowingly
committed to uh uh had contributed to
because you never knew their true
selves so we need good Tech policy and
we're not getting it in fact we're
getting bad techn technology policy
that's getting worse by the day
so um you may remember that uh in over
the last 2 years we discovered that
hospitals are computers that we put sick
people into and when we take the
computers out of the hospitals they
cease to be places where you can treat
sick people and that's because of an
epidemic of ransomware there's been a
lot of focus on the bad it policies of
the hospitals and the hospitals had some
bad it policies you shouldn't be running
Windows XP there's no excuse for it and
so on but ransomware had been around for
a long time and it hadn't taken down
hospitals all over the world right the
way that ransomware ended up taking down
hospitals all over the world is somebody
took some offthe shelf ransomware and
married it to a thing called Deep Blue
that or Eternal blue rather and eternal
blue was an NSA exploit they had
discovered a vulnerability in Windows XP
and rather than taking it to to
Microsoft and saying you guys have
better patch this because it's a really
bad zero day they had just kept it
secret in their back pocket against the
the day that they had an adversary they
wanted to use it against except before
that could happen someone leaked their
cyber weapon and then dumb Dums took the
Cyber weapon and married it to this old
piece of ransomware and started to steal
Hospitals now why do I call these people
Dum Dums because the ransom they were
asking for was
$300 right they didn't even know that
they'd stolen hospitals they were just
opportunistically stealing anything that
was connected to an XP box and then
asking for $300 in cryptocurrency in
order to unlock it right so this is not
good technology policy the NSA believes
in a Doctrine called no bus no one but
us is smart enough to discover this
exploit now first of all we know that's
not true we know that the NSA from the
crypto Wars we know that the NSA does
not have a monopoly on Smart
mathematicians right these were the
people who said Dez 50 were strong
enough for anyone they were wrong about
that they're wrong about this but even
if you believe that the NSA would never
uh that the exploits they discovered
would never be independently
rediscovered it's pretty obvious that uh
that doesn't mean that they won't be
leaked and once they're leaked you can
never get that toothpaste back in the
tube now since the uh the enlightenment
for 500 years now we've understood what
good knowledge creation and Technology
policy looks like so let me give you a
little history lesson before the
enlightenment we had a thing that looked
a lot like science through which we did
knowledge creation it was called Alchemy
and what Alchemist did is a lot like
scientists You observe two phenomena in
the universe you hypothesize a causal
relationship this is making that happen
you design an experiment to test your
causal relationship you write down what
you think you've learned and here's
where science and Alchemy part ways
because Alchemists don't tell people
what they think they've learned and so
they are able to kid themselves that the
reason that their results seem a little
off is because maybe they made a little
mistake when they were writing them down
and not because their hypothesis was
wrong which is how every Alchemist
discovers for himself the hardest way
possible that you should not drink
Mercury right so for 500 years Alchemy
produces no dividends and then
Alchemists do something that is
legitimately miraculous they convert the
base metal of superstition into the
precious metal of knowledge by
publishing by telling other people what
they think they've know what they know
not just their friends who go easy on
them but their enemies right who if they
can't find a single mistake in their
work they know that their work is good
and so as a first principle whenever
you're doing something important
everyone should be able to criticize it
otherwise you never know that it works
so you would hope that that's how we
would operate in the information
security realm but that's not how we're
operating in 1998 Congress passed this
law the Digital Millennium Copyright Act
they then went to the European Union in
2001 and arm Twisted them into a um uh
passing the European Union copyright
directive and both of these laws have a
rule in them that says that you're not
allowed to break digital Rights
Management you're not allowed to bypass
a system that restricts access to a
copyrighted work and in the early days
this was primarily used to stop people
from making region-free DVD players
right but now everything's got a
copyrighted work in it because
everything's got a system and a chip in
it that cost 22 cents and has 50,000
lines of code including the entire Linux
Linux kernel and usually an instance of
busy box running with the default root
password of admin and Bin
right and because that's a copyrighted
work um anyone who manufactures a device
where they could make more money if they
could prescribe how you use that device
can just add a one molecule thick layer
of DRM in front of that copyrighted work
and then because in order to reconfigure
the device you have to remove the DRM
they can make removing DRM and thus
using your own property in ways that
benefit you into a felony punishable by
a 5-year prison sentence and a $500,000
fine and so there's this enormous
temptation to add DRM to everything and
we're seeing it in everything pacemakers
voting machines uh car engine parts
tractors uh um implanted defibrillators
hearing aids there's a new uh uh
continuous loop or closed loop
artificial pancreas from Johnson and
Johnson it's a a continuous glucose
monitor married to a an insulin uh uh
pump with some machine learning
intelligence to figure out what dose you
need from moment to moment and it uses
proprietary insulin C cartridges that
have a layer of DRM in them to make sure
that to stay alive you're you only feed
your internal organ the material that
the manufacturer has approved so that
they can charge you an extreme markup so
that's bad that's the reason we're
seeing DRM everywhere but the effect of
that is on SEC is uh what it does to
security research because under this
rule merely disclosing defects in
security that might help people bypass
DRM also exposes you to Legal Jeopardy
right so this is where it starts to get
scary because as microcontrollers are
permeating everything we use as
hospitals are turning into computers we
put sick people into we are making it
harder for critics of those devices to
explain the dumb mistakes that the
people who made them have made we're all
drinking Mercury um and this is going
everywhere particularly it's going into
your browser so several years ago the
w3c was approached by Netflix and a few
of the other big entertainment companies
to add DRM to HTML 5 because it was no
longer technically uh simple to to put
DRM in browsers because the way they
were changing the API and the w3c said
that they would do it and there's it's a
long complicated story why they went
into it but I personally and eff we had
a lot of very spirited discussions with
the w3c leadership over this and we
warned them that we thought that the
companies that wanted to add DRM to
their browsers didn't want to just
protect their copyright we thought that
they would use this to stop people from
disclosing defects in browsers because
um they wanted to be able to not just
control their copyright but ensure that
there wasn't a way to get around this
copyright control system and they said
oh no never these companies are good
actors we know them they pay their
membership dues they would never abuse
this process to come after uh security
researchers who are making good faith
honest responsible disclosures whatever
you add your adjective for a disclosure
that's made in a way that doesn't make
you sad right there are all these
different ways of talking about security
disclosures and we said all right let's
find out let's make membership in the
w3c and uh participation in this DRM
Comm committee contingent on promising
only to use the dmca to attack people
who infringe copyright and never to
attack people who make uh security
disclosures and the entire
cryptocurrency Community who are and
blockchain Community who are in the w3c
working groups they backed us on this in
fact it was the most controversial
standards vote in w3c history was the
only one that ever went to votes the
only one that was ever appealed it was
the only one that was ever published
without unanimous support it was
published with 58% support and not one
of the major browser vendors not one of
the big entertainment companies signed
on to a promise not to sue security
researchers who revealed defects in
browsers so let's talk a little about
security economics and browsers so
security obviously it's not a binary
it's a Continuum we want to be secure
from some attack you heard someone talk
about threat modeling earlier um so like
you got a bank vault um you know that
given enough time and a plasmic torch
your adversary can cut through that bank
vault but you don't worry about that
because your bank vault is not meant to
secure your money forever it's meant to
secure your money until a security guard
walks by on their patrol and calls the
police right your bank vault is
integrated with the rule of law it is a
technical countermeasure that is
backstopped by the rule of law and
without the rule of law your bank vault
will eventually be cut open by someone
with a plasma cutter so security
economics means factoring in the
expected return on a breach into the um
uh design of the system right if you
have a system that's protecting $500 in
assets you want to make sure that it
will cost at least $51 to defeat it and
you assume that you have a rational
actor on the other side who's not going
to come out of your breach $1 in the
whole right you assume that they're not
going to be Dum Dums um so uh the this
there's a way that this uh frequently
goes wrong a way that you get context
shifts that change these security
economics calculus um and that's when
the value of the thing that you're
protecting suddenly goes up a lot uh and
the security measures that you're using
to protect it don't and all of a sudden
your $500 security measure uh or $51
security measure isn't protecting $500
worth of stuff it turns out that it's
protecting $5 million worth of stuff and
the next thing you know there's some
dude with a plasma cutter hang H around
your Vault so this challenge is
especially Keen in the realm of
information security because information
security is tied to computers and
computers are everywhere and because
computers are becoming whoops because
computers are becoming integrated into
every facet of our life faster than we
can even keep track of it every day
there's a new value that can be realized
by an attacker who finds a defect in
computers that can be widely exploited
and so every day the cost that you
should be spending to secure your
computer is going up and we're not
keeping up in fact computers on average
are becoming less secure because the
value that you get when you attack
computers is becoming higher and so the
the um expected uh uh adversary behavior
is getting uh better resourced and more
dedicated so this is where
cryptocurrency does in fact start to
come into the story uh it used to be
that if you found a defect in widely
used consumer Computing Hardware you
could expect to realize a few or at best
a few thousand but um in a world where
intrinsically hardto secure computers
are being asked to protect exponentially
growing cryptocurrency pools well you
know how that works right you've seen
cryptojacking attacks you've seen all
the exchanges go down you understand
what happens when the value of the asset
being protected shoots up very suddenly
it becomes extremely hard to protect so
you would expect that in that world
where everything we do is being
protected by Compu computers that are
intrinsically hard to protect and where
we need to keep adding more resource to
protect them that states would take as
their watchword making crypto as easy to
implement as possible making security as
as easy as possible to achieve but the
reverse is happening instead what's
happening is states are starting to
insist that we're going to have to
sacrifice some of our security to
achieve other policy goals so this guy
used to be prime minister of Australia
he's not anymore wait 6 months the
current pres Prime Minister of Australia
will also not be prime minister of
Australia anymore anymore um this guy
Mal Malcolm uh
Turnbull sorry did I just get his name
wrong um I just blew up his name uh what
is his name God he went so quickly
Malcolm turble it is Malcolm turble it's
right there on the slide I I almost
called him Malcolm Gladwell uh so he he
gave this speech where he was explaining
why he was going to make it the law that
everybody had to backd Door their crypto
for him and you know all these
cryptographers had shown up and they
said well the the the laws of math say
that we can't do that we can't make you
a thing that's secure enough to protect
the government and it's Secrets but
insecure enough that the government can
break into
it and he said and I'm not going to do
the accent uh he said the laws of
Australia Prevail in Australia I can
assure you of that the laws of
mathematics are very commendable but the
only law that applies in Australia is
read it with me the the law of Australia
I
mean this may be the stupidest
technology thing ever said in the
history of really dumb technology
utterances but he almost got there and
he's not alone right the FBI has joined
him in this call uh um you know Canada's
joined us joined him in this call like
if you ever needed proof that that
merely having good pecs and good hair
doesn't qualify you to have good
technology policy the government of
Justin Trudeau and its technology policy
has demonstrated this forever right this
is an equal opportunity Madness that uh
every uh developed state in the world is
at least dabbling
in um and uh we have ended up not just
in a world where fighting crime means
eliminating good security I me it's
dumber than that right We've Ended up in
a world where making sure people watch
TV the right way mean sacrificing on
security Now the European Union they
just actually had a chance to fix this
because that copyright directive that
the US forced them to pass in 2001 that
has this stupid rule in it that they
borrowed from the dmca it just came up
for its first major Revision in 17 years
the new copyright directive uh is
currently nearly finalized it's in its
very last stage and rather than fixing
this glaring problem with security in
the 21st century what they did was they
added this thing called Article 13 so
Article 13 is a rule that says if you
operate a platform where people can
convey a copyrighted work to the public
so like if you have a code repository or
if you have Twitter or if you have
YouTube or if you have SoundCloud or if
you have any other way that people can
make a copyrighted work available if you
host Minecraft skins you are required to
operate a crowdsourced database of all
the copyrighted works that people care
to add to it and claim so anyone can
upload anything to it say this copyright
belongs to me and if a user tries to
post something that appears in the
database you are obliged by law to
censor it and there are no penalties for
adding things to the database that don't
belong to you you don't even have to
affirmatively identify yourself and the
companies are not allowed to strike you
off from that database of uh allegedly
copyrighted works even if they
repeatedly catch you chaffing the
database with garbage that doesn't
belong to you the works of William
shakes all of Wikipedia uh the source
code for um some key piece of blockchain
infrastructure which now can't be posted
to a WordPress blog and discussed until
someone at automatic takes their
tweezers and goes through the database
and pulls out these garbage entries
whereupon a bot can reinsert them into
the database one nond later so this is
what they did instead of fixing anti-
circumvention rules to make the internet
saf for security so uh I mentioned this
is in its very last phase of discussion
and it looked like it was a fix and then
the Italian government changed over and
they flipped positions and we're
actually maybe going to get to kill this
but only if you help uh if you're a
European please go to savey your
internet. and send a letter to your MEPS
this is really important because this
won't be fixed for another 17 years if
this passes save your
internet. so when we ask ourselves why
are governments incapable of making good
technology policy the standard account
says it's just too complicated for them
to understand right how could we expect
these old decrepit irrelevant white
dudes to ever figure out how the
internet works right if it's too
technological you're too old right but
sorting out complicated technical
questions that's what governments do I
mean I work on the internet and so I
think it's more complicated than other
people stuff but you know on when I'm
being really rigorously honest I have to
admit that it's not more complicated
than public health or sanitation or
building roads and you know we don't
build roads in a way that is as stupid
as we have built the internet and that's
because the internet is much more hotly
contested because every realm of
endeavor intersects with the internet
and so there are lots of powerful
interest engaged in trying to tilt
internet policy to their advantage right
the TV Executives and uh media
Executives who push for Article 13 you
know they're not doing it because
they're mustache twirling villains
they're just doing it because they want
to line their pockets and they don't
care what cost that imposes on the rest
of us bad policy bad Tech policy it's
not bad because making good policy is
hard it's bad because making bad policy
has a business
model now Tech did not cause the
corruption that distorts our policy
outcomes but it is being supercharged by
the same phenomenon that is distorting
our policy outcomes and that's what
happened with Ronald Reagan Margaret
thatch
and their cohort who came to power the
same year the Apple 2 plus shipped and
among the first things they did in
office was dismantle our antitrust
protections and allowed companies to uh
do all kinds of things that would have
been radioactively illegal in the
decades previous like buying all their
competitors like engaging in illegal
tying like um uh using uh long-term
contracts in their supply chain to force
their competitors out uh like doing any
one of a host of things that might have
uh landed them uh in front of an
antitrust regulator and broken up into
smaller pieces the way AT&T had been um
and as that happened we ended up in a
period in which inequality mounted and
mounted and mounted and 40 years later
we've never lived in a more unequal
world we have surpassed the state of
inequality of 18th century France which
for many years was the gold standard for
just how unequal a society can get
before people start chopping off other
people's heads and unequal states are
not well-regulated ones unequal states
are states in which the padillo
cherished Illusions and personal
priorities of a small number of rich
people who are no smarter than us start
to take on outsized policy Dimensions
where the preferences and whims of a few
plutocrats become
law so in a
plutocracy policy only gets to be
evidence-based when it doesn't piss off
a rich person and we cannot afford
distorted technology policy we are at a
Breaking Point our security and our
privacy and our centralization debt is
approaching rupture we are about to
default on all of those debts and we
won't look like we won't like what the
bankruptcy looks like when that arrives
which brings me back to crypto currency
and the bubble that's going on around us
um the uh the bubbles they're not fueled
by people who have an ethical interest
in decentralization or who worry about
overreaching state power they those
bubbles right all the frothy money
that's in there not the coders who are
writing it or the or the principal
people who think about it but all the
money that's just sloshing through it
and and making your uh tokens so
volatile that the security economics are
impossible that money is being driven by
looters who are firmly entrenched in
authoritarian States the same
authoritarian States states that people
are interested in decentralization say
we want to get rid of they're the ones
who are buying cyber weapons to help
them spy on their own populations to
figure out who is fermenting revolutions
so they can round them up and torture
them and arrest them so that they can be
left to loot their National treasuries
in peace and spin the money out through
financial secrecy Havens like the ones
that we learned about in the Panama
papers and the paradise papers and
abetting the oligarchic accumulation of
wealth that is not going to create
creates the kinds of states that produce
the sound policy that we need to make
our browsers secure it will produce
States whose policy is a funhouse mirror
reflection of the worst ideas of the
sociopaths who have looted their
National wealth and installed themselves
as modern feudal
Lords your cryptography will not save
you from those States they will have the
power of coercive force and the
unblinking eye of 247 surveillance
contractors
the internet the universal Network where
Universal Computing endpoints can send
and receive cryptographically secure
messages is not a tool that will save us
from coercive States but it is a tool
that will give us a temporary shelter
within them a space that even the most
totalitarian of regimes will not be able
to immediately penetrate where reformers
and revolutionaries can organize
mobilize and fight back where we can
Demand free fair and open societies with
broadly shared Prosperity across enough
hands that we can arrive at consensuses
that reflect best evidence and not the
whims of a few where power is
decentralized and incidentally having
good responsive States Will Not Just
Produce good policy when it comes to
crypto all of our policy failures can be
attributed to a small moneyed group of
people who wield outsized power to make
their bottom line more important than
our shared Prosperity whether that's uh
the uh people people who uh spent years
expensively sewing doubt about whether
or not cigarettes would give us cancer
or the people who today are assuring us
that the existential threat that the
human species is facing is a conspiracy
among climate scientists who are only in
it for the
money so you're here because you write
code and you may not be interested in
politics but politics is interested in
you the rule of law needs to be your
Alpha and Omega because after all all a
constitution is is is a form of
consensus right it's it's it's the
original consensus seeking mechanism
using the rule of law to defend your
technology it's the most internet thing
in the world let's go back to Bernstein
when we went to Bernstein and argued
this case we essentially went on an
internet message board and made better
arguments than the other people and we
convinced the people who were listening
that our arguments were right this is
how you folks resolve all of your uh
problems right proof of concept running
code good arguments and you win the rule
you win the battle of the day so making
change with words that's what everybody
does whether we're writing code or
writing law and I'm not saying you guys
need to stop writing code but you really
need to apply yourself to the legal
Dimension too thank
[Applause]
you
than thank you
so we're going to ask some questions now
um I like to call alternately on people
who identify as women or non-binary and
people who identify as male or
non-binary and we can wait a moment if
uh if there's a woman or non-binary
person who wants to come forward first
there's some uh there's a mic down there
and then there's a Rover with a mic just
stick up your hand
there any hands up there does someone
have their hand up is that what that
person was shouting in audibly from the
back no all right are there any people
identify as men or non biner you'd like
to ask the first question there's
someone there if there's a runner with a
mic maybe or if you want to come down to
this
microphone H someone's coming now
as someone who spent a lot of time
involved in the internet I'm sure you've
read the book The sovereign individual
and I recently read this book and it
talked a lot about how the internet will
increase the sovereignty of individuals
and also how cryptocurrencies will and
it predicted a massive increase in
inequality as a direct result of the
internet could you comment on that yeah
I haven't read the book so I'm not going
to comment directly on the book but I
think it's true that if you view
yourself as separate from the Destinies
of the people around you that it will
produce inequality I I think that that's
like empirically wrong right like if
there's one thing we've learned about
the limits of individual sovereignty
it's that you know you have a shared
microbial Destiny you know I speak as a
person who left London in the midst of a
measles epidemic and landed in
California right after they stamped It
Out by telling people that you had to
vaccinate your kids or they couldn't
come to school anymore um we do have
shared Destinies um we don't have
individual sovereignty uh and even if
you the greatest and you know anyone
who's ever run a business knows this
right you could have a coder who's a
100x coder produces a 100 times more
lines of code than everybody else in the
business but if that coder can't
maintain the product on their own and if
they're a colossal that no one
else can work with then that coder is an
is a liability not an asset right
because you need to be able to work with
more than one person in order to attain
superhuman objectives which is to say
more than one person can do and
everything interesting is superhuman
right the limits on what an individual
can do are pretty strong um and so yeah
I I'm I'm I think I think that that's
true I think that that the uh kind of
policy bent towards selfishness kind of
self-evidently produces more selfish
outcomes but not better ones right uh
not not ones that are um not ones that
reflect uh uh kind of a Shar shared
prosperity and growth thank you
hi hi I have had the pleasure of seeing
you keynote both decentralized web
Summits and the ideas you bring to these
talks always really St with me longer
than anything else um with with what
you've talked about here this is
honestly one of the most intimidating
and terrifying uh topics and I'm
wondering what what are some ways
besides staying informed and trying not
to get burned out by it all what are
some ways that people can make a
difference so uh I recently moved back
from London to California as I mentioned
uh and one of the things that that means
is I have to drive now and I'm a really
shitty driver and in particular I'm a
really shitty Parker and um so when I
have to park I do a lot of this and then
a lot of this and then a lot of this and
then a lot of this and what I'm doing is
I'm like moving as far as I can to gain
one inch of available space and then or
centimeter and then moving into that
centimeter available space because that
opens up a new space that I can move
into and then it open and then I move as
far as I can and I open up a new space
we do this in Computing all the time
right we call it hill climbing we don't
know how to get from a to zed but we do
know how to get from A to B right right
we can we know where the higher point of
whatever it is we're seeking is
stability or or or you know density or
interestingness or whatever and so we
move one step towards the the our
objective and from there we get a new
vantage point and it exposes new avenues
of Freedom that we can take I don't know
how we get from A to Z I don't know how
we get to a better world and I actually
believe that because the first casualty
of every battle is the plan of attack
that by the time we figured out the
terrain that it would have been obliter
ated by the adversaries who don't want
us to go there um and so instead I I
think we need heuristics and that
heuristic is to see where your freedom
of motion is at any moment and take it
now uh Larry leig he's got this
framework the four forces code law norms
and markets uh my guess is that most of
the people in this room are doing a lot
with norms and and markets right that's
kind of where this this conference sits
in that little 2 by two um and as a
result you may be blind to some of the
code and so some of the law and Norm
issues that are available to you right
that that it might be that jumping on
eff's mailing list or if you're a
European getting on the edre mailing
list or if the mailing list for the uh
individual digital rights groups in your
own countries like um Nets politi and
Germany or uh the uh quadrature toet in
France or um open Rights group in the UK
or uh bits of freedom in the Netherlands
and so on getting on those lists and at
the right moment calling your me calling
your MP or even better yet like actually
going down when they're when they're
holding surgeries when they're holding
constituency meetings they don't hear
from a lot of people who are
technologically clued in right like they
only get the other side of this and you
know I've been in a lot of these policy
forums and often times the way that the
other side prevails is just by making it
up right like one of the things we saw
in this filter debate like we had
computer scientists who were telling
MEPS you know the 70 most eminent
computer scientists in the world right a
bunch of cing Prize winners uh Vince
Surf and Tim Berner Lee said like these
filters don't exist and we don't know
how to make them and they were like oh
we got these other experts who say we
know how to do it and they the they had
been told for years that the only reason
nerds hadn't built those filters is they
weren't nerding hard enough right and if
they actually hear from their own
constituents people who run small
businesses that are part of this big
frothy industry that everybody wants
their National economies to participate
in who show up at their lawmakers
offices and say this really is
catastrophic it's catastrophic to my
business it's catastrophic to the
internet they listen to that right it
makes it moves the needle and and you
know you heard earlier someone say are
we at Peak P are we at pitch now well I
should pitch right I work for Electronic
Frontier Foundation we're a nonprofit
the majority of our money comes from
Individual donors it's why we can pursue
issues that are not necessarily on the
radar of the big foundations or big
corporate donors we're not beholden to
anyone uh and it's people like you right
who keep us in business uh and you know
I don't draw money from eff I'm a MIT
media lab uh research affiliate and they
give eff a grant that pays for my work
so the money you give to eff doesn't
land in my pocket uh but I've been
involved with them now for 15 years and
I've never seen an organization squeeze
a dollar more so I I really think it's
worth your while eff.org thank
you oh someone over here yes
hi that that mic is off oh there you go
thank you very much really appreciate
the speech it was very inspiring um I
think maybe not sure how many other
people feel this way but one thing
that's been hard to me about politics in
general especially in the age of social
media is you know there's a lot of it
that spreads messages of fear and anger
and hatred and sometimes it feels like
when you want to say something and you
want to spread a certain Voice or or or
just spread a certain message that
there's this fear of getting swept up in
all these messages and and ideas and
things that aren't
necessarily you're not necessarily aware
of your own biases and things like that
how does one Stay s stay sane and fight
for you know the right fight God I you
know I wish I knew I like I I'll freely
admit to you I've had more sleepless
nights in the last two years than in all
the years before it I mean even during
the the movement and nuclear
proliferation that I was a big part of
in the 80s when I thought we were all
going to die in a mushroom cloud I
wasn't as worried as I am now it's tough
I mean for me like just in terms of like
personal psychological opsc uh I've
turned off everything that um
non-consensually shoves Donald Trump
headlines into my eyeballs uh you know
that we talk a lot about how like
engagement metrics distort the way
applications are designed but you know I
really came to understand that that was
happening about a year and a half ago um
so for example they changed the default
Android search bar so that when you
tapped in it showed you trending
searches well like nobody has ever gone
to a search engine to find out what
other people are searching for right and
the trending searches were inevitably
Trump threatens Nuclear armagedon So the
last thing I would do before walking my
daughter to school every morning is I
would go to the weather app and I would
tap in it to see the weather and it's
news and it's weather and headlines and
the only headlines you can't turn off
are top headlines and they're trending
you know they're all Trump threatens
nuclear Armageddon right so I realized
after a month of this that what had been
really the most calming grounding 10
minutes of 15 minutes of my day where I
would walk with my daughter to school we
talk about stuff and it was really quiet
we live on a leafy Street I just spend
that whole time worrying about dying
right and so I had to figure out how to
like go through and turn all that stuff
off now what I do is I block out times
to think about headlines so I go and I
look at the news for a couple hours
every day and I write about it I write
boing boing right I write a blog about
it not necessarily because my opinions
are such great opinions but because
being synthetic and thoughtful about it
means that it's not just buffeting me
right it's it's it's it's becomes a
reflective rather than a reflexive
exercise but I don't know right I mean I
think that and I don't think it's just
the tech I think we are living in a
moment of great psychic trauma we are
living in a and you know the the reason
the ipcc report was terrifying was not
because of the shrill headlines the ipcc
report was terrifying because it is
objectively terrifying right and and so
how do you make things that are I I
don't know how you make things that are
objectively terrifying not terrifying I
think the best we can hope for is to
operate while we are terrified with as
much calm and a plum and uh
thoughtfulness as it's possible um how
are we for time do you want me off I
know my clocks run out or can I take one
more question stage
manager one more
or one more all right and then we'll
then we'll ring us off yeah hi hi better
be good though okay I'm ready I work for
the media lab too um so my question Cory
thank you for your talk I think uh a lot
of people in the cryptocurrency world
think about um the current systems that
we exist in and we're trying to exit
those systems to some extent and create
parallel Financial you know political
institutions what have you versus
expressing voice within the current
system how do you balance um exit versus
voice in the current system well you
know in a techn in a in a I said before
that like a constitutional argument is
just an internet flame War by another
means right so uh when you're arguing
about a commit and a pull request one of
the things you do is you do proof of
concept right you show that the thing
that you are patching is real and can be
exploited or you show that your you run
unit tests to show that your patch
performs well those parallel exercises
are useful as proof of Concepts and as
uh unit tests right they're prototypes
that we can fol back into a wider world
and um I I think that the the thing I
worry about is not that technologists
will build technology I want
technologists to build technology it's
that they will think that the uh the job
stops when you've built the proof of
concept that's where the job starts
right when you can prove that you've
written a better algorithm you then have
to convince the other stakeholders in
the project that it's worth the actual
like nonzero cost of patching to make
that to make that work right of of going
through the whole Source tree and
finding all the dependencies on the
things that you're pulling out and Grace
replacing them because you know when you
run a big data center you can't just
start patching stuff you've got a you've
got a tool chain that you have to
preserve right and so that's that's
where the job starts right build your
proof of concept build us a parallel
Financial system build us a whatever so
that we can figure out how to integrate
it into a a much wider more pluralistic
world not so that we can separate and
sead on our little you know world over
there as you know like it doesn't matter
how great you're you're thank you
doesn't matter how great your your your
uh bunker is right like you can't shoot
germs right like if your solution allows
the rest of the world to fall into chaos
and no one's taking care of the
sanitation system you will still
yourself to death of chalera in your
bunker because like you can't shoot
germs right so we need pluralistic
solutions that work for all of us thank
you thank
you all right thanks
everyone e