- Hey, I'm Cory Doctorow
and I work with the Electronic Frontier Foundation.
I'm a special advisor there.
And this talk it's based on a paper
that I co-wrote with my colleague at EFF, Bennett Cyphers,
that is his real name.
And that paper is also called "Privacy Without Monopoly"
same title as this talk,
you can download it at eff.org/dc29,
that's down there in the URL, DEFCON29.
Now look, anytime someone talks about big tech
and the Internet's monopolization,
someone will bring up the term, network effects.
Now, network effects are what economists call
product or service that gets better,
the more people there who are using it
and tech companies do in fact,
enjoy network effects.
The fact that the people you wanna talk to are on Facebook
is a reason for you to join Facebook.
And once you join Facebook,
that's reason for people who wanna talk to you
to join Facebook
or every time so it makes an iPhone app.
That makes the iPhone itself
a more valuable thing to have
'cause there's more apps for it.
And every time someone goes out and buys an iPhone,
'cause there's more apps for it,
that's a reason to make more apps
because there's more customers for those apps.
But network effects,
they're only half of the story.
Network effects are why companies get big,
but they're not why companies stay big.
Network effects give critical mass
to big companies, right?
So once they get to a certain size,
they just keep growing because they have so many users
that people keep joining them
because they want the benefits of those network effects
and they keep adding users.
But if you wanna understand why these companies stay big,
why users don't leave,
you have to look at switching costs.
That's another term from economics jargon,
switching costs or whatever you have to give up
to leave a product or a service.
Like if you quit Facebook,
you leave behind the friends and family members
and the communities and the customers
that you found there, right?
Or that you joined there to be with.
If you leave behind Google, you'll lose search.
Sure, but you lose your apps
and maybe you lose your mobile platform.
And if you wanna quit iOS,
you have to say goodbye to the apps
and the proprietary files
that those apps created that you bought for iOS.
Now, these switching costs, aren't an accident,
they don't come naturally,
they're actually engineered into the system.
After all, you can switch mobile carriers
without losing contact with your friends.
You don't even have to change your phone number.
You don't have to tell them you've changed
from like Verizon to Sprint.
There's no technical reason.
Facebook couldn't be designed to let you
keep talking to your Facebook friends
even after you leave Facebook.
After all Facebook has spent millions of dollars
and they've conducted endless research
to figure out how to let you stay with your friends
when you join Facebook,
think of all that technical expertise in UX
that goes into conning you into uploading your address book
to Facebook so that once you get there,
they can automatically hook you up
with all the friends who are already there.
And when new friends joined,
they can figure out that they know you.
But not only has Facebook failed to produce tools
to help you stay in touch with your Facebook friends
when you leave Facebook,
they've actually devoted substantial engineering
to make it harder for you to maintain your relationships
if you have the temerity to stop using their service.
In other words, Facebook,
just like every tech monopolist does everything it can
to raise the switching costs for users
who leave for a rival service.
Now, why did tech companies want high switching costs?
Companies need to balance their interests and your interests
as their customer or user.
Now, sometimes customers and companies,
they have the same interest,
like if you make an app and I buy that app from you,
neither of us wants that app to crash,
we want it to be good,
but sometimes those interests diverge
and when they diverge,
when what's best for the customers
and what's best for the company,
the company wants to resolve those issues in their favor.
But when a company doesn't
that were downs to their benefit and your cost say like,
"Gouging you on the price or sucking up
"a bunch of your personal identifying information,"
they run the risk that you'll be so upset
that you will quit the service.
And so that's where switching costs come in.
The higher a switching cost is
the more company gets to abuse you
before they lose you as a customer.
That is, if the cost of preserving your privacy
is less than the cost of losing touch
with your Facebook friends,
the communities and the customers that you have there,
then Facebook gets to abuse your privacy
and they don't have to worry about losing you as a customer.
The more you stand to lose
by quitting our product or a service,
the more value the company behind that product or service
can shift from your side of the balance sheet
to their side of the balance sheet
without losing your business.
Now, fortunately for our Internet Connected World,
general purpose computers
connected to general purpose networks,
they eat switching costs for breakfast.
All the stuff that we talk about at this con,
reverse engineering, scraping and capsulation,
compatibility layers, quirks modes, virtualization,
they all boil down to the same thing.
There are ways to connect something new
to something that already exists.
In other words, they're tools for interoperability.
interop is a profound and crucial part of the design
of a network to technological society.
All other things being equal interop puts a limit
on how badly a company gets to abuse its customers.
So think for a minute about how Apple
managed to kick Microsoft's at the start of this millennium.
The office programs that Microsoft made for the Mac
were really terrible,
so much so that workplaces transitioned everyone,
even their graphic designers to windows,
because that was the only way they could share documents
with the rest of the team.
Every Microsoft office document that anyone created
using windows made windows more valuable.
That's what we call the network effect,
but not using windows meant that you were cut off
from every Microsoft office user
and that is the switching cost.
Apple undid the network effect
by annihilating the switching cost.
The way they did that was by making a program
called the iWork suite,
which decomposed into three smaller programs
called pages, numbers, and keynote
that they made by reverse engineering,
the Microsoft file formats
and making interoperable products.
After that, the switching costs fell to basically zero.
Network effects are how companies get big,
but high switching costs are why they stay big.
And that's why companies do everything they can
to raise switching costs.
They use a lot of technological countermeasures,
that kind of stuff we talk about here,
DRM, obfuscation, tamper resistance,
boot lockers, all kinds of stuff,
but they also use legal countermeasures.
And those are a little more insidious,
it's the kind of thing EFF spends a lot of time on,
laws like section 1201
of the digital millennium copyright act
that bands bypassing DRM
even if you're not doing anything nefarious
or the computer fraud and abuse act,
this Ronald Reagan era cybersecurity law
that has been stretched to cover
all kinds of legitimate activity,
especially the kind of thing that security researchers do
as well as things like software patents
and weird and obscure legal theories
like tortious interference with contract and more.
All of those countermeasures,
the technological ones and the legal ones,
that's how big tech stays big.
And the higher the switching costs,
the more big tech gets to abuse us
because the higher the switching costs
the worst that abuse has to be before,
it makes sense to switch.
And that brings me to privacy.
Remember the talk is called "Privacy Without Monopoly."
Companies don't invade your privacy because they're nosy,
they spying you because spying on you
makes them more profitable.
Google and Facebook, they invade your privacy
because it makes their ad targeting service more valuable.
It's not why Apple does it,
Apple invades Chinese user's privacy
like by backdooring its cloud service
and blocking working VPNs from the iOS app store in China.
They do that to preserve its access to Chinese customers
and far more importantly, Chinese manufacturing.
Interoperability lowers switching costs,
and that makes it easier to switch away
from a company whose products invade your privacy.
And that means that companies are less likely
to wanna invade your privacy in the first place,
because they understand that if they do,
they might lose you, you might lose your business.
But if they go ahead and do it anyway, you get to switch.
And that is something that lawmakers have figured out.
We have seen legal interoperability mandates,
these are laws or regulations that require companies
to inter-operate with smaller new market entrance
proposed in the United Kingdom, the U.S, the European union,
and elsewhere all over the world.
And these bills and regulations,
they propose one or more of three kinds of interoperability.
The first kind is one
that you're really familiar with, I'm sure,
data portability.
That's when a company has to produce
a standards defined blob of your data,
a snapshot that you can either use for your own,
or maybe upload to arrivals so that you can start there
with everything configured the way you like it
and your social graph intact.
The second kind is a little more exotic,
it's called back-end interoperability,
that's when a company is required by law to expose an API
so that third parties can use it to exchange platforms
with data with dominant platforms.
And the third kind is called delegate ability,
that's interoperability for the front end.
So it would be a requirement that companies
have some kind of standardized way
to script their user interfaces
so that you as a user might nominate someone else
to autopilot parts of the service on your behalf,
maybe to moderate content,
or like, imagine if you wanted to finally
turn on location privacy in Google,
this is something that's notoriously hard to do.
Google engineers who work on location privacy,
can't figure out where all the check boxes are
that you have to tick off
in order to have good location privacy with Google
and if you miss just one, you got no privacy.
So maybe Privacy International
would just throw some resources at that,
figure out what the recipe was for getting you good privacy
for your location on Google
and then you could delegate the ability
to navigate all of Google's nefarious
and Baroque settings pages on your behalf to PI
and they'd go ahead
and they would give you a location privacy.
(clears throat)
Now, not withstanding that last example,
interop complicated relationship to privacy.
On the one hand interop promises to allow users
to reclaim their privacy,
by switching from high surveillance services
to privacy respecting rivals
whether those are like co-ops or non-profits
or public services or startups,
and they'd get to do so without sacrificing
their relationships and the benefits
that they used to get from interacting
with those big dominant services.
And interoptherefore puts pressure
on the dominant services to be better on privacy,
because the low switching costs mean that the choices
that put shareholders' interests
ahead of user's interests will result in the immediate loss
of users and revenue.
But on the other hand,
interoperability could be a privacy nightmare.
And like, what if a privacy abusing company,
a company that's even worse on privacy than say,
Google or Facebook wants to plug into one of those services,
after all Google and Facebook,
yeah, they invade the hell out of your privacy,
but they're playing an iterated game,
they're not gonna be so bad
that you leave the service straight away,
they're trying to keep that in balance.
But what if it's a new company
that doesn't care about keeping your business,
they just wanna steal your data?
Earlier this summer at the House Judiciary Committee
held markup hearings on six antitrust bills,
including the access act,
which is one of these interoperability mandates,
it's a law that would force big companies
to expose their APIs to rivals.
And some of the lawmakers there,
they asked a good question.
They said like,
"What if I'm Chinese state-owned enterprise
use one of these APIs
and just sucked up a bunch of sensitive data?
Or what if it was just a company,
a company like Cambridge Analytica that could get an API key
and use the API to just harvest all kinds of data
under false pretenses?
Now, those are really excellent questions.
Unfortunately,
the answers that tech companies give to them
are really stupid.
Companies like Facebook and Google and Apple,
they say that they have already attained
the optimum level of interoperability,
just the right trade off between user privacy
and user freedom.
And they save that they know that they've done this
because they have the same interests as their users
and the best way to make sure
that no one nefarious ever gets to plug into their system
is to give them free reign to block interoperability
whenever they think it makes sense to do so.
Now, whenever the Fox starts telling us
about how good it is at guarding our henhouse,
we should be suspicious.
So like when Facebook tells us that we can trust it,
not to let Cambridge Analytica plug into its service
and get all of our data,
we should be pretty skeptical of that claim
because Facebook already did let Cambridge Analytica plug
into its service and get all of our data.
Every platform,
from Google to Apple, to LinkedIn, to Microsoft.
And yeah, I know that's the same company.
One of the things that's happened over the last 40 years
as we've allowed companies to monopolize
is that the web has turned into like five giant websites,
so it was screenshots of text from the other four.
And all of those big companies
have either intentionally allowed
someone to suck up all of our private data,
because it redounded to their profit
or they screwed up their security so badly
that someone was able to do it without their permission.
Monopolous can't be trusted
to decide who gets to compete with them
and how, and when, obviously.
But of course does come with serious privacy risks,
and proposals to fix interop should address this risk.
And they do,
but in an ideal world, the way we fixed most of this risk
is by America adopting a strong federal privacy law,
a law that specified when consent needed to be obtained
and in order to gain access to your information
and to process it.
And that would describe what consent was, right?
Consent can't just be,
I've shown you a dialogue box with 30,000 words of like,
garbage legalees that no one is ever gonna read
and I agree button underneath it.
A law like that would clarify some hard problems,
like do you need your friend's permission
to export the private messages that they sent you
when you quit one service and go to another one.
Now, there is a version of this in the European union.
There's the GDPR, the General Data Protection Regulation,
GDPR, it's a mixed bag,
it sometimes gets a bad rap, but even with all of its flaws,
it is still a democratically arrived upon set of rules
for data processing.
And if those rules have flaws,
there's a democratic process for amending them.
And that's a lot better than how no privacy laws at all
the way America does,
and it's also a lot better than having
whatever privacy rules we have,
unilaterally set behind closed
in corporate monopolous boardrooms with no recourse.
Now, a good federal privacy law
shouldn't just spell out the rules for obtaining consent.
It should also have a private right of action.
That's a lawyer's term for when you get to sue
to defend your rights,
instead of having to get the federal trade commission
or your local district attorney, or the attorney general,
or some other authority to take up your cause
and spend their blood and treasure
to make sure you get justice.
With a federal privacy law
that had a private right of action,
a lot of the thorniest problems with interop,
they just go away,
like whether you get to take your friend's annotations
on your photos with you
when you export those photos and go to a new service.
Does your address belong to you
because you uploaded it to Facebook
or does it belong to Facebook
because they added new information to it as you used it?
As well as some really, really hard questions,
like, even if we agree
that you should have to get your friends consent
to export the messages they send you to another service,
does that still apply if the person whose private messages
you are trying to export
or the messages that your stalker
or your harasser sent to you,
that you wanna hang onto
in case you need to get a restraining order,
do they get to tell you
that you're not allowed to take those messages with you
when you quit a service that wasn't willing
to use moderation policies
to defend you from that harasser and go somewhere else?
Now, when governments order companies to interoperate,
they don't just need to rely on a Federal Privacy Law,
they can go beyond what the law says,
and if there is no law,
they can create some protections
in interoperability mandates.
So for example,
the first version of the access act,
which was introduced last year in the Senate,
it said that the FTC should create a new kind of company,
kind of arms length, special referee,
that would be in charge
of protecting the users of big platforms.
And when someone started a new service
that wanted to plug into, one of the big platforms, APIs,
they would evaluate that service
and decide whether or not that service was on the up and up,
they wouldn't be allowed to compete with that service
or with the big dominant platforms,
they would have to have no conflicts of interest,
and they would decide whether or not your new service
would be able to plug into the API.
And if so,
like what a fair rate for using the API would be
to recover the cost of operating the servers
that provide you with a data conduit.
Now, the access act got reintroduced this year in the house,
not the Senate, and it did away with these third parties,
what you might call a fiduciary
and it replaced them with something else
that's also pretty good,
a set of rules for what kind of company is allowed
to connect to the API,
rules like those companies are not allowed
to collect or monetize or share user data ever.
Now, interoperability mandates have their place.
Interoperability mandates are kinda how we got here.
Like if you're my age,
you'll remember that the golden age
of long distance bulletin board systems
came about as a result of an interoperability mandate
that forced the phone
to allow third party long distance carriers
to connect to them,
and that's when suddenly you could connect to BBSs
far from your home without having to be a phone freak
and risk doing federal time.
But there is another kind of interop
beyond these interop mandates.
And that's the kind of interop that Apple used
when it reversed engineered Microsoft offices file formats
and made pages and numbers and keynotes.
It's the kind of interop that people at this kinda con
should be pretty familiar with,
after all, no one ordered Microsoft to give Apple
the spec for its file formats and Apple didn't ask Microsoft
for permission to do so.
Microsoft actually did everything it could
to obfuscate those file formats.
They didn't just not cooperate with Apple,
they actively opposed
anyone reverse engineering their file formats.
And Apple did it anyway.
That interop is called adversarial interoperability.
Or we at EFF,
we call it competitive compatibility or calm, calm.
This is really hard to say adversarial interoperability.
So when I say ComCom, then competitive compatibility,
which is also adversary interoperability.
See, you learn something new every day.
So ComCom is in the story of every tech monopoly
that was knocked over,
and every new tech company that rose to greatness.
ComCom is that impolite zero given form of interop
that doesn't care if the way that I plugged my thing
into your thing, major shareholder said,
"ComCom is in this story of everything from IBM PC clones
"to Hayes modem command sets, to SMB and Samba networking,
"to the Browser wars and the rise of the web,
"and of course, online music,"
but there is a new and impenetrable thicket of laws
and legal interpretations,
cybersecurity laws like the computer fraud and abuse act,
anti circumvention laws like section 1201 of the GMCA
software patents and more
that have made this once routine practice of ComCom
into a legal minefield
that today is almost entirely practiced in the shadows.
We need lawmakers and regulators to restore ComCom.
And one way they can do that is by reforming existing laws
so that they're no longer so broad
that can be used to block interop,
or you could pass a new law,
a kind of inter operators defense that said,
"Not withstanding all the other laws,
"it's not an offense to add features
"or modify a product or service for a legitimate purpose."
It would shield you from liability,
if you were making replacement parts or fixing something
or improving its security or adding lawful features
or making it accessible to people with disabilities.
And there's another way we could do it,
as the FTC pursues Gianopoulos
and enters into settlements with them,
'cause they don't wanna spend 10 or 15 years in court.
One of the conditions of those settlements
could be that the companies agreed
not to use these laws to shut down into our operators.
They could still use copyright law to stop people
who were violating their copyright,
but not just people who've bypass to TPM.
Now, mandatory interoperability
and adversarial interoperability,
they're not exclusive, they're not contradictory,
they are extremely complimentary.
We want mandatory interop because it's orderly.
If there's a mandated API for one of the big services,
then the way that you make something new that plugs into it
is by reading the docs,
looking at the reference code and building your app.
Now, compare that with the messy guerrilla warfare
of ComCom,
in order to plug into a service,
you might have to fuzz its inputs or find a flaw in its IDS
or bypass it's bootloader, and then every time they patch,
you have to do it all over again.
But ComCom is useful here
because mandatory interop is so brittle.
Companies have a lot of ways
to break their mandatory interop
without violating the letter of the law,
they could pre-touch really shut down
their API over and over again
because of suspicious activity
or they could just restructure the internal data model
so that the fields that the API can access
are no longer useful to a competitor.
When a company nerfs it's mandatory API, getting that fixed,
involves a full-blown regulators investigation.
It involves appeals, it involves a judgment,
it involves an order and enforcement,
and it could take years during which time
those little services that have popped up
to give users more freedom might just collapse.
But if ComCom is legally safe,
if you're allowed to do ComCom
then the day that accompany breaks its API,
all those little companies that rely on it
can switch to scraping or reverse engineering
or other adversarial tactics.
In fact, companies are so frightened
of the unquantifiable risk
that's posed by free for all bot wars,
that in many cases,
they're just gonna resist the temptation
to wreck their APIs because the alternative is worse,
but if they go for it anyway,
if they're reckless enough to shut down the API
and brave the wrath of the regulator,
well, then ComCom fills in the gaps
while we wait for the FTC to wake up
and smack them around a little.
Let me give you a concrete example of how that works
and how it fails.
Back in 2012,
Massachusetts passed a ballot initiative
with an overwhelming majority
that forced the big three automakers
to supply independent mechanics
with the data they needed to read diagnostic information
off the wired network and cars, what's called the can bus.
Car-makers had spent years systematically monopolizing
independent car service,
and they had been doing so by obfuscating those diagnostic
and repair messages and people in Massachusetts
had enough of it.
But even before that law came into effect,
car-makers started redesigning their cars
so that all that useful diagnostic information,
no longer float over the canvas,
it flowed over new wireless meshes.
Those weren't covered by the law.
Now eventually Massachusetts passed a law
that overrode those loopholes,
that forced automakers to expose the data
that was going over those wireless networks,
but it took eight years.
And during those eight years,
independent mechanics had a choice.
They could either just have cars that they couldn't fix,
or they could close their shops and go to work
for one of the big automakers.
The mismatch between the time it takes to subvert a mandate
and the time it takes to fix it again
is why mandates alone are not enough.
For mandates to work they need counterweights,
a consequence that befalls companies that subvert them
that hurts worse than obeying the mandate
in the first place.
And that counterweight that's ComCom.
Imagine, for example, if car-makers
who are breaking their diagnostic mandate
had to worry about ComCom when they were doing that.
Imagine if when they switch the service messages
from the wired network to that exempted wireless network,
a couple of smart MIT kids
could have just entered the market
with a raspberry PI based interpreter
that costs them a dollar to make,
that they could sell to every mechanic in the state for $20
and that would continue to read those wireless messages
as they flew around in the car.
Anything the car manufacturers
did to freeze out those gadgets
would mean retooling every authorized service center
and dealing with the inevitable upgrade problems.
Meanwhile, independent mechanics would have a new business
to supply them with diagnostic tools
that MIT kids startup
and that business could offer other services to them,
services that made the manufacturers
even less important to independent repair services.
ComCom therefore is the stiffener
that turns these otherwise structurally unsound mandates
and to sturdy and pro competitive solutions.
Now, ComCom just like every other kind of interop
has plenty of ways that it can be abused for privacy.
Today, companies say that they stopped ComCom
from abusing our privacy
by using anti circumvention enforceable terms of service
and other anti-competitive laws
to safeguard their users' privacy.
But if we really wanna defend user privacy,
we need a privacy law.
We shouldn't be letting companies
improvise this highly selective privacy defense regime
from random cybersecurity and copyright laws
had been lying around since the Reagan era.
With an actual privacy law,
we wouldn't have to rely on companies to tell us
what the good ComCom and the bad ComCom was.
We could tell what was good and what was bad,
good ComCom didn't violate privacy law and bad ComCom did.
Now, we've just underwent a half century
of official tolerance for monopoly,
but we are at a turning point.
The president's latest executive order
says that America's new policy
is officially anti-monopoly and sets out 72 directives
to the various administrative agencies
to make that a reality.
There are six antitrust bills going through Congress.
There is also state level antitrust action.
There's antitrust action in Canada,
the UK, and the European union
with laws like the digital markets act
and the digital services act.
This is quite a moment that we're having,
but the point of this fight,
isn't just about competition for its own sake.
I mean, every time a company Apple does something good,
like introducing anti-fracking technology,
the ad-tech industry starts whining
that this is anti-competitive, and they're not wrong.
Apple does make it harder to compete in the race to see
who is best at violating our human rights
most cheaply and prolifically,
but that's not a race we want.
We don't want competition
to find the best human rights violator.
We wanna ban human rights violations,
interoperability, and privacy rules together,
do more than just enhancing competition or choice.
They do something more nobler indeed,
they give us technological self-determination.
The right to decide how our technology works
either by changing it ourselves
or by finding someone we trust to change it for us.
So you can stick with a big company if it's got your back,
but you can switch away if it doesn't have your back,
because companies do sometimes have their user's backs.
If a platform knows that the users
aren't cowed by switching costs,
they're incentivized to treat those users well.
I'm not here to say that companies
will always screw their users.
I mean, I know a lot of you people watching this,
do good hard work on behalf of those companies
to defend dumdums like me.
I'm not a hacker, but no one is ever going to pay you
to defend me from your boss, especially not your boss.
Interoperability and privacy law.
They're how we make it so that you don't have to.
Now, that's the end of the talk.
And if you want more detail,
I urge you to read the paper once again,
it's called "Privacy Without Monopoly"
and you can read it,
you can see the URL down there, eff.org/dc29.
I'd like to thank again, my colleague Bennett Cyphers,
who did all the heavy lifting on this paper,
I hope you will give the paper a read.
And I'm really looking forward to seeing you next year
for DEFCON30 in person.
Assuming we haven't all been killed
by the Zeta variant by then.
Please get vaccinated, wear your mask.
We will get through this fellows and folks,
and gosh, fellows, that was a terrible way to end a talk
that I managed to pull off
without any gaps all the way through.
We will get through this folks.
Please do what you can to keep us all healthy
and thank you for the hard work you're doing
and for your attention.
I really hope you enjoy the rest of DEFCON.
Thank you very much.