Name: Brainstorm Tech 2023: Pushing for Privacy
Uploaded: 2023-07-11
Duration: 15 min 23 s
Description: Meredith Whittaker, President, Signal In conversation with: Roy Bahat, Bloomberg Beta

Meredith Whittaker, President, Signal In conversation with: Roy Bahat, Bloomberg Beta

Brainstorm Tech 2023: Pushing for Privacy

Conferences

So tracking users as they make their way across the web and uses of personal data that are not always clear ethical. These are some of the issues that have eroded everyday people's trust in tech Google, Facebook, Amazon, Apple, Twitter, companies smaller and larger have all faced their share of scrutiny from regulators and users over how well they protect data and how they use what they collect. So today, we are thrilled to host MEREDITH Whitaker who has long criticized Big Tech for its occasional maybe not its occasional axis and lack of visibility from within the industry. In terms of protecting that data. MEREDITH worked for Google for over a day, holding its top managers to account and even organizing some of the Google Walkouts, powerful protests that demanded more transparency, accountability and respect for user privacy. MEREDITH currently serves as the president of Signal, an open source encrypted messaging app that offers strong protection of users privacy and data. It's also a favorite of journalists. So when you have scoops, you call it some signal, she's also the co founder of AI now Institute, a research institute dedicated to exploring the social implications of AI and advocating for ethical development and deployment. MEREDITH will be interviewed by the head of Bloomberg Beta Roy Bahat. And it's worth taking a second to say that Roy has been an invaluable advisor to our brainstorm tech program. He has served as co chair and so we really truly appreciate his input and expertise. And so here we are for an interview. Please welcome MEREDITH Whitaker and Roy Bahat. Thank you. All right. So signal, just curious how many people here in the audience have used signal within the last week, let's say, OK, great. Me too. Um Used by tens of millions of people. I know you don't do numbers many, many million, 100 million downloads on Android. It used by the most elite government officials to keep secrets. Criminals. Look, we don't collect user data so you don't know. OK, funded by a founder of whatsapp and, and, and donations. But originally, so why should somebody use signal? Well, people should use signal because they want two parties in their conversation, the person they're talking to and themselves, they don't want three. Well, and so, but hold on. That's the same thing WhatsApp says, right? I see signs on the billboard saying you want your conversation secure and to end encrypted. It is the same thing. WhatsApp says, WhatsApp uses the signal protocol to encrypt and protect the contents of your messages. So what you're saying, what whatsapp doesn't do is protect the metadata. So information about who you are, who you're talking to your group, text your contact lists and other, you know, extremely important information. I think there's a quote from James Clapper that said metadata gets you 80% of the waste and knowing what you need to know. So we need to recognize it's a whole package. We're also not owned by meta, which I think is a pretty important detail. Who are you owned by? We are a nonprofit. There's a Signal Foundation is solely dedicated to stewarding the Signal LLC which develops the app and I am effectively president of both. But under the, and one of the things that struck me about it was how many employees, roughly three or four dozen, something like that. A little over 40 right? And so that's a pretty small number of people to run something used by as many people as it's used. It's a very elite team, but we are punching way above our weight, right? We're not a tech company, we're a small organization with one, you know, clear focus. And so you worked at Google for a long time, you know, you work closely with Meta when you see the enormous numbers of people that work for these companies. Are they making mistakes, do they just have too many people? No, I mean, it's incredibly difficult to develop high availability software that works the way that people expect it to work, right? But we're also not, we're not a media broadcast company, we're not, you know, we don't have a policy team all over the world. We're really focused on, you know, developing, deploying and maintaining truly private communications apps in a world that is, you know, has never been more surveilled. Right. Right. So I'm going to ask about that in a second and let's talk about some of the privacy policy, one more question about the organization, which is when you were at Google, you were one of the organizers of the Google Walkout. And so you had, I think the perspective of an employee in that and now you're the boss. Yeah. How does that change your perspective on things if your, if your employees were unionized or organized, how would you feel? How is it different being the boss? I, you know, I would say go for it and do it smart. Don't be silly about this. This is very serious. We're, you know, geopolitically critical core infrastructure, you know, we're not messing around, but that's really not my business. It great. OK. So let's talk about some of the policies and privacy in particular because you've been on a world tour talking about privacy. I'm going to articulate a naive view that you can disabuse me of the naive view is we're fine on privacy. The, you know, eu at GDP and California has a privacy law and even meta has an end to end encrypted app. So we're going to be OK, but literally no one says that. Right. I don't know. A lot of consumers say it because they seem not to care, they'll click through a user agreement. They care about their friends knowing if they were texting somebody, they shouldn't be knowing. But do they care about a big tech company knowing? It's not as clear, this is not a matter of individual choice. So I think what has happened over the, you know, handful of decades in which the surveillance business model has interpolated our core infrastructure to the point that we're surveilled to an extent, we don't have a sense of is that that choice has been made for us. You know, we can't get a job without having an account on different platforms. It is a flag in certain sort of algorithmic profiling software. If you don't have a social media account that's considered suspicious, right? You can't go to work and do your job oftentimes without being surveilled. So we're talking about sort of socially significant infrastructure that if you wanted to opt out truly, if you cared enough to do something, you're living in a cabin in the woods with no contact with people. Right? So again, we're talking about a collective issue and I think people care very, very deeply, but what they don't have is agency to do anything about it in most cases, which is why you've been focused on working with governments. It sounds like, well, it's why I've been focused on making it clear to governments in this moment that it's incredibly important not to undermine, end to end encryption, which is the technology we have that can actually guarantee private communications. If you don't have another way to see, we see with some governments, I mean, France proposed or enacted a law, you tell us that would allow the government to turn on your camera remotely and they're claiming law enforcement as a reason why they need a back door. And so what is, what's the right way to think about it? Well, look like there's a long history to this. And I don't, you know, we're not going to get those in power to abandon their pursuit of information, asymmetry as a tool of power. And that's what surveillance gives them, right? Like that throughout history, we can look at like the history of the 16th century statistics that were used for population control. We can, you know, move forward, we can look at proto surveillance technology, the hollow you can't tax unless you know who they are. I mean, there are some valid and unless you know what they have, right? Like you can't define who you get to tax unless you start having borders and enumerating. Is that right? You know, it's fairly straightforward, but this is not a new impulse with networks computation. This is a long history, network computation has metastasized to an extent. I don't think we can conceptualize very clearly, but it remains true that we still need a way to communicate privately. And so which governments are you paying the closest attention by the US of what they do in the UK? While you explain why if folks have questions, we'll come around and do questions. But by the UK, usually people are not shaking in their boots at the UK S surveillance. If you've worked in tech for a while, um, they're a bit tricky and the Five Eyes Agreement makes it very difficult to sort of understand how that's going to. But the UK has a bill called the online safety bill. This is one of those like omnibus tech regulations that become a Christmas tree for everyone's special little pet tech regulatory project. It's not all bad, but it's very, very messy. And there's one provision clause 101 that would give Ofcom, who is their independent competition and Telecom regulator, the power to mandate that everyone in the UK install what they're calling approved technology that would scan your messages before they're encrypted before they're sent so effectively mass surveillance of everyone's communication. That's then, you know, we don't have the specs but the technological prototypes that have been forwarded are laughable and deeply insecure. I would signal. No, wait, wait, wait, let me, let me because I, you know, I got to complete the thought. So they're laughable and insecure and what's happening is not only is the UK proposing this power for Ofcom, that's Well, along the way, you have governments around the world who don't want to be the first to implement this type of precedent setting of surveillance, looking to the UK as a sort of templates, liberal democracy as the sort of permission set. So the precedent was set here, we in Uganda are now going to implement this to say, detect people talking about LGBT Q resources and you know, under the law that has now passed murder them because being gay is punishable by death in Uganda. This is really serious of stuff. And I do feel like the sort of futuristic haze that everyone has been in for a year or so around AI and these sort of big questions has let this sneak up on us and there's a real need for tech leaders and others who get the stakes of this technology to speak up. Like if you all have Rishi soak on your signal messages and can drop him a DM, please do because I do think it's that serious would signal be legal under that UK regime. How about the messages even be scammed? They would order us to implement it. We would not and we would there would be because there is no secret back door at signal despite what well everything in signal is open so you can see for yourself. But you know, audit after audit Infotech researcher after Infotech researcher has combed through signal and when they find, you know, a small issue. They tell us we improve it. But it is this is, this is technology used around the world that has been validated repeatedly as truly secure. So it sounds like what you see your role as and correct me if it's wrong is you're trying to stop that first domino of a socially acceptable regime, implementing some form of surveillance that you find unacceptable. I wear many hats as one of us. OK. Yeah, one of those hats. And so let's talk about who you've made common cause with because if I think about companies have been accused of surveillance as a business model, you hear meta, I mean meta is the core of the others. OK? And yet you've made common cause with them. No, no, no, no, no, no. What's common cause? What do you mean by common cause? We have a issue convergence. There's two circles, the diagram is not two circles, there's a little narrow sliver in the middle where we do agree. What is that? Sliver? Whatsapp uses the signal protocol to encrypt the contents of messages. Meta is moving to apply the signal calls to messenger messages in Facebook. This protects people and their privacy. We have a case right now in Nebraska where a mother has been now convicted of a felony that will, you know, she'll serve at least two years in prison for helping her daughter access criminalized reproductive care right after dogs pass, she's not going to prison. And why did that happen? How did that happen? What evidence established her guilt. That was Facebook turning over meta, the DMS between the mother and daughter, neither meta wants that nor signal is that I don't care what Meta wants. I know what is right and what is right is we don't let one massive corporation with very little oversight determine the surveillance society we live in, in collapse with governments, right? We're talking, you know what happens when a librarian in Florida hands a book that is banned to a child, right? Are we scanning those messages? Like this is very close at hand and it's not a gang like so I don't know if this is a common cause or not. I don't know if this is a trick question. What I'm talking about is this is the right thing to do. And if we have to, you know, if perilous times call into being strange coalitions so be it. Yeah. No, it's not a trick question. Yeah. Well that here, OK. I don't even know what the fuck would you? OK. We've got a couple more minutes here and so if folks have questions, I invite them to chime in. But now I just wanna ask you, looking ahead, you've been warning about these dangers for a long time. Uh has anything that's unfolded in the last few years surprised you in terms of how encryption privacy ai I mean, you've been a vocal critic of whether it's even possible to have privacy and ai, at the same time. Yeah, I don't think you can. I, I don't, I don't know, like, I, you know, I go to bed thinking about this, I wake up thinking about this. I'm very, like, intellectually engaged with these topics. So I don't know if surprise is the right descriptor. But I do think the way that the anti encryption sort of regulatory agenda sort of snuck in around 2018 has been a bit alarming to me, right? So in 2015, we had Apple and the showdown with the FBI around San Bernardino. And there was a, you know, there was a moment of, I would say, you know, from my perspective, victory there where it was clear like, you know, it was established, you cannot create a back door that only the good guys can go through. This is mathematically impossible to weaken security and not undermine the security of our core communications, core infrastructures, etcetera. And then 2018, you started seeing this being sort of floated under other banners. And you know what I think has happened in a sense is you have this sort of ai hype and magical thinking where a lot of people with, you know, a lot of self interest in many cases are claiming that artificial intelligence can do magical things, terminators, that kind of thing, its sentences, it will surpass humans. And so there is a suspension of disbelief around what technology can do. And that has bled into the encryption debate such that we're now undermining the very clear arguments that were made in 2015. And before around the, you know, factual impossibility of breaking encryption just for the good guys and people are now, you know, advertising ai based technologies or others that they effectively claim can conduct mass surveillance privately. All right, we got one minute left. I am going to ask my trick question. I've been a signal user for a long time in the last few years. All I can really remember in terms of new features is stories which I know are useful in other countries and the elimination of SMS on Android. What can the users expect in terms of how the signal app will get better? Yeah. Well, you know, we're a small team and maintaining and ensuring the robustness of the app is its own job. So, you know, we're not looking to be like Microsoft Word. We don't want a bunch of feature blows so our engineers can like meet their OK. R we don't work that way, but we are we on user names which will allow people to contact each other without sharing a phone number anonymously. That kind of thing, which is important, particularly in countries where you have to register personal information to get. Is that new news or something you've announced before? Asking for the journal? I haven't announced that before. Yeah, I mean, we don't, you know, I'm up here to talk substance. I don't have like a flashy give. No, of course, we're talking about teachers in the future. All right. Thank you for courageous stances and for sharing it here. Thanks everybody and to be continued. Thank you.