Speech Given Given at the First Conference on Computers, Freedom, and Privacy

Contents

Privacy, Technology, and the Open Society
        John Gilmore
        Given at the First Conference on Computers, Freedom, and Privacy
        March 28, 1991
        Public domain -- not copyrighted

My talk concerns two ethics -- the belief in an open society and the
belief in privacy.  I think these two ethics are related to each other,
and I would like to say something about how they relate to our conduct
in the world.

This society was built as a free and open society.  Our ancestors, our
parents, our peers, and ourselves are all making and building this
society in such a way -- because we believe such a society outperforms
closed societies -- in quality of life, in liberty, and in the pursuit
of happiness.

But I see this free and open society being nibbled to death by ducks,
by small, unheralded changes.  It's still legal to exist in our society
without an ID -- but just barely.  It is still legal to exist by paying
with cash -- just barely.  It is still legal to associate with anyone
you want -- unless they bring a joint onto your boat, photograph naked
children for your museum, or work for you building a fantasy
roleplaying game.  And I think conferences like ours run the risk of
being co-opted; we sit here and we work hard and we talk to people and
build our consensus on what are relatively minor points, while we lose
the larger open society.

For example -- we have the highest percentage in the world of our own
population in jail.  We used to be number two but last year we passed
South Africa.  We are number one.

Over the last ten years we've doubled the number of people in jail.  In
fact, those extra cells are mostly filled with people on drug charges,
a victimless crime that as recently as twenty years ago was accepted
and was celebrated behaviour.

Now, I'd like to ask people in the room, please raise your hand if you
have not broken a law, any law, in the past month.

   [one person raised his hand, out of about 400].

OK.  Please raise your hand if your disks and back-ups were searched,
would there be something there you are not allowed to have?  Please
raise your hand if your disks are clean.

   [more hands -- maybe twenty to forty]

We have a few more takers here.

But it's no wonder we are concerned about privacy, because we are all
"lawbreakers", We all break the law, but few of us are criminals.  The
problem is that simply attracting the attention of the police is enough
to put the best of us at risk, because we break the law all the time
and it's set up to make that happen!

Now I don't blame the cops for this.  They mostly just enforce the bad
laws that the legislatures write, but in fact the legislatures aren't
completely at fault either, because in the long run, only educating the
whole population about the benefits of openness has a chance.  And this
is something that I try to contribute to regularly, and I think I do a
little bit of work in this area.

But even beyond that, as P. T. Barnum said, "Nobody ever lost money by
underestimating the intelligence of the American public."  Where I hold
out the most hope is in a different approach.  In the paraphrased words
of Ted Nelson, we probably can't stop this elephant but maybe we can
run between its legs.

In most of Europe, phone companies don't record the phone numbers when
you call, and they don't show up on your bill.  They only tick off the
charges on a meter.  Now, I was told that this is partly because the
Nazis used the call records that they used to have, to track and
identify the opposition after taking over those countries in World War
II.  They don't keep those records any more.

In the U.S., people boycotted the 1990 census in record numbers.  I
think that the most shameful story of how Japanese-Americans were
rounded up using census data had a lot to do with that.

Professor [Lawrence] Tribe talked [at the conference] about the deep
distrust that we must hold for our government.  We have to realize that
people who run the government can and do change.  Our society, and our
permanent rules, must assume that bad people -- criminals even -- will
run the government, at least part of the time.

There's been a lot of talk here about privacy ... but we haven't
focused so much on why we want it.  Privacy is a means; what is the
real end that we are looking for here?  I submit that what we're
looking for _increased tolerance_.

Society tolerates all different kinds of behaviour -- differences in
religion, differences in political opinions, races, etc.  But if your
differences aren't accepted by the government or by other parts of
society, you can still be tolerated if they simply don't know that you
are different.  Even a repressive government or a regressive individual
can't persecute you if you look the same as everybody else.  And, as
George Perry said today, "Diversity is the comparative advantage of
American society".  I think that's what privacy is really protecting.

The whole conference has spent a lot of time talking about ways to
control uses of information and to protect peoples' privacy after the
information was collected.  But that only works if you assume a good
government.  If we get one seriously bad government, they'll have all
the information they need to make an efficient police state and make it
the last government.  It's more than convenient for them -- in fact,
it's a temptation for people who want to do that, to try to get into
power and do it.  Because we are giving them the means.

What if we could build a society where the information was never
collected?  Where you could pay to rent a video without leaving a
credit card number or a bank number?  Where you could prove you're
certified to drive without ever giving your name?  Where you could send
and receive messages without revealing your physical location, like an
electronic post office box?

That's the kind of society I want to build.  I want a guarantee -- with
physics and mathematics, not with laws -- that we can give ourselves
things like real privacy of personal communications.  Encryption strong
enough that even the NSA can't break it.  We already know how.  But
we're not applying it.  We also need better protocols for mobile
communication that can't be tracked.

We also want real privacy of personal records.  Our computers are
extensions of our minds.  We should build them so that a thought
written in the computer is as private as that thought held in our
minds.

We should have real freedom of trade.  We must be free to sell what we
make and buy what we want -- from anyone and to anyone -- so we can
support ourselves and so we can accomplish the things we need to
accomplish in this world.

(You don't have to applaud for all of these...)

Importantly, we need real financial privacy because the goods and
information cost money.  When you buy or sell or communicate, money is
going to change hands.  If they can track the money, they can track the
trade and the communication, and we lose the privacy involved.

We also need real control of identification.  We need the option to be
anonymous while exercising all of these other rights.  So that even
with our photos, our fingerprints and our DNA profile, they can't link
our communication and trade and financial activities to our individual
person.

Now I'm not talking about lack of accountability here, at all.  We must
be accountable to the people we communicate with.  We must be
accountable to the people we trade with.  And the technology must be
built to enforce that.  But we must not be accountable to THE PUBLIC
for who we talk to, or who we buy and sell from.

There`s plenty of problems here.  I think we need to work on them.
Just laws need to be enforced in such a society.  People need to find
like-minded people.  And somebody still has to pay the cost of
government, even when they can't spy on our income and our purchases.
I don't know how to solve these problems, but I'm not willing to throw
the baby out with the bath water.  I still think that we should shoot
for real privacy and look for solutions to these problems.

So, how do we get from here to this kind of society?  One way is to
stop building and supporting fake protections, like laws that say you
can't listen to cellular phone calls.  We should definitely stop
building outright threatening systems like the Thai [National] ID system
or the CalTrans vehicle tracking system.

Another thing to do is, if you know how, start and continue building
real protections into the things you build.  Build for the US market
even if the NSA continues to suppress privacy with export controls on
cryptography.  It costs more to build two versions, one for us and one
for export, but it's your society you're building for, and I think you
should build for the way you want to live.

If you don't know how to build real protection, buy it instead.  Make a
market for those people who are building it, and protect your own
privacy at the same time by putting it to use.  Demand it from the
people who supply you, like computer companies and cellular telephone
manufacturers.

Another thing is to work to eliminate trade restrictions.  We should be
able to import the best from everywhere and we should be able to export
the privacy and the best of our products to the rest of the world.  The
NSA is currently holding us hostage; Mainframe manufacturers, for
example, haven't built in security because they can't export it.  IBM
put DES into their whole new line of computers, and they were only
going to put it on the U.S. models, but the NSA threatened to persecute
them by stalling even their allowable exports in red tape.  IBM backed
down and took it out.  We can't allow this to continue.

We also need to educate everyone about what's possible so we can choose
this kind of freedom rather than assume it's unattainable.

Finally, we need to keep cash and anonymity legal.  We'll need them as
precedents for untraceable electronic cash and cryptographic
anonymity.

I think with these approaches, we'll do a lot more for our REAL freedom,
our real privacy, and our real security, than passing a few more laws
or scaring a few more kid crackers.  Please join me in building a
future we'll be proud to inhabit and happy to leave to our children.
Thank you.