UPA Privacy Summit @ BUIDLWeek with Michelle Lai and special guest Juan Benet

gonna just close it that would be great [Music] perfect um is it good yeah I think great all right good morning everyone uh it's great to be here with you uh so I have a kind of an interesting talk today uh this is probably different from many of the talks that I give usually although Snippets of this have been in other talks uh what I want to talk about today is modern orwellian States and how to prevent them who here's familiar with 1984 a lot of folks yeah who here is red 1984. perfect um so what if we wrote 2024 today and we thought about the technology that we have now uh and try to do what Orwell did in around that time and said what if we deployed all of the technology that we have in this moment to try and build the world's worst orwellian state uh so that's what this talks about and we're going to go through these kinds of orwellian States and what they might be able to do uh we're going to go through how to prevent them and then we're I'm going to talk primarily about secure Communications because that's what most of the people in this conference in this room are working on and this is one of the key functions of being able to prevent this kind of problem uh by the way this is a a an AI generated image uh there was like a really nice lucky shot like very early like only took like one or two prompts to get to this so dpd's thinking about it too uh so a quick definition of orwellian States uh think of a Draconian level of propaganda surveillance disinformation denial of Truth and manipulation of the past and so on I think at the time the level of surveillance that you could have was rate limited by just humans being able to monitor things like radio frequencies and people don't have the degree of recording or computational power that we have now so in a sense kind of the original Orwell perspective was very very tame uh in comparison to the surveillance you can have now uh so today like what's what's changed since then first of all uh the most important thing is we have this enormous little Communications Network that has been this huge gift to all of humanity uh enabling us to talk to everybody around the world um and coordinate and cooperate in ways uh that are kind of magical to to our ancestors at the same time though that same telecommunications Network um has you know cameras all the time um microphones uh GPS tracking uh all kinds of you do most of your interactions through them so most of humanity is now put it pouring all of its interactions through this same telecommunications Network uh and that's a great choke point for a would-be orwellian state creator also another major uh thread is the rise of AI that this means we can do massive scale data analysis uh nowadays within we have enough computing power to do it real time we can do automated systems control so you can uh have systems that are responding to situations real time and you could even have behavioral ml models for all humans on the planet so imagine that you have a digital counterpart that is predicting your every move your every action based on everything that you've said and an orwellian State uh Creator I would be able to use that to coordinate what the appropriate response would be to any human and that's you know using existing systems today now the last couple of years have seen this uh set of breakthroughs around uh the latest Transformers and so that means that now we have the ability to kind of generate massive amounts of content and so that means that all the propaganda stuff gets dramatically easier uh it means that all of the kind of this information gets easier it means also that summarization of vast droves of data gets dramatically easier so no longer are you rate limited by humans trying to parse lots of complex data you can probably just feed most of it to Transformers and figure it out and this is only current AI systems I'm not even considering what might arrive this year or next year which we should expect will be significant breakthroughs let alone something you know close to 2030. so let's kind of talk through surveillance moment you as I mentioned you could do this kind of complete surveillance of all humans on the planet you could monitor all the traffic you could look at all the metadata you don't even have to decrypt the traffic you can use inference on the metadata to figure out a lot of the interactions you can tap into all of the phone data GPS position audio video Communications data Health Data you can then of course crawl through all of the vastroves of social media artifacts um and use that to feed into your models of people and what they might be thinking and what they might do and also we have CCTV everywhere now it's kind of this is a uh we're kind of like past the point of this being avoidable we're like welp uh into the world of okay great so this is the infrastructure that we have how do we make sure that this remains human aligned in terms of propaganda we have uh vast you could have vast level of control of news and Publications you could out publish any other group of of people uh you could control facts and reality you could flood social media these days in the last five to ten years we've seen the rise of this information and how difficult it is to get people to agree on what reality is plus you've uh feed in all of the latest stuff around um just making these interactions real time so not only are you publishing propaganda you can now generate agents that are convincing people real time so you could have an interaction with a group of people of what you think are people online and they're not they're just Bots trying to convince you of something uh you could also feed this into population control so you could have uh you know straightforward control theory style behavioral feedback loops where you're measuring reactions and then adjusting certain parameters um and feeding them back into the system and seeing how humans respond to that and keep doing this so that you you don't kind of overstep your balance as a norwellian dictator or whatever and kind of uh make everyone so mad at you quickly enough that they overthrow you you can said do it very slowly to ratchet up the power and Ratchet up the control and set in this extremely difficult um uh kind of Vice and you can think see the beginnings of these kinds of things in the credit systems that are being deployed around the world now they're not kind of extreme yet like there was a lot of concern about this a couple of years ago um and so far the the criticisms haven't kind of stepped very far into this but the structure and the the infrastructure for doing all of this is there now so you could just change the parameters and alter how you measure and why you measure what you value to drive this so think of the control theory side Loops that uh pilot airplanes and that applied to entire populations at a time so you could do you could do this today uh this is uh starting to this is the one where it's like not quite there yet but it's starting to to get here um automated this is you could do automated enforcement of all actions so in the digital side this is already here uh real-time analysis and response you can have a coordinated set of worldwide agents and and operate at this massive scale although physically you can't quite this is the kind of the boundaries that we're passing now where we now have uh large enough uh and good enough uh robotics to be able to uh have real world automation but it's not so good yet like for example you can still Escape robots by just going upstairs now I don't have to convince you that totalitarianism is really bad uh I hope uh and so you know this is kind of like a snapshot of like what that kind of orwellian state can lead to uh because usually what tends to happen is some state gets into into Power establishes this level of social control on surveillance and then over time that power starts shifting and the policies of the state start dominating um and so it's never really the first group uh that established that kind of um control that that end up using these these kinds of policies so how do these systems arise so from you know if you're already starting from a dictatorship pretty easy you just kind of implement all of this orwellian and stuff however from democracies it's not actually that far uh you can Implement most of these systems and many many democracies around the world have parts of this in the name of Public Safety so uh usually most of this kind of infrastructure and surveillance is extremely useful to do really good legitimate public safekeeping and law enforcement and all of that makes sense however the problem is that once you build it you build this apparatus that somebody can inherit so that means eventually some bad intention Administration inherits those Powers Takes Over Control and then can start ratcheting it ratcheting up the control um of of why these systems give you this is what makes it extremely difficult and today many groups are on fighting about these systems um and usually you know it's never really about the current Administration most current administrations in democracies tend to be pretty good um you know it's a huge spectrum of course but we've had extremely bad uh governments in the past so for the most part it's not really about the people in control now uh what everybody should be worried about is do not build these kinds of systems because once they're in place they can be inherited by groups dramatically worse than the ones that are in power today so um practically for uh some kinds of States like this you implement pieces of these systems you demonstrate value for Public Safety you start ratcheting up power and control and then if it's successful you start exporting it to other countries so that's uh the dark picture of what or what in the States you could build today if we wrote uh 2024. so how do we stop these things so what's difficult for for totalitarianism first off an educated public so reliable this means reliable media schools and learning and you need humans around the world to be drastically better able to discern what's right what's true what's not and how to interact you can also set up certain policies and government structures that make it very difficult for totalitarian regimes to take control so this includes balanced government structures very strong institutions and so on I'll talk a little bit about policy in a moment also key technological improvements can help tremendously here uh we'll talk primarily about secure Communications though coordination tooling can also be extremely useful and last but not least strong economies so it turns out if you go back and look at most totalitarian Rises they they tend to happen in periods of massive economic instability because that's when people are at their most convincible of any kind of group that might kind of alleviate situations so by having a strong economy you can um prevent these kinds of problems so let's talk about policy for a moment uh the world has hundreds of democracies there's lots of great strong institutions most want to prevent orwellian States um most about debate security versus privacy and they tend to trade off security in terms of normal well-being and kind of law enforcement and so on and privacy in terms of respecting people's right to privacy but but thanks to many uh bad examples like Cambridge analytic and so on it has made clear that privacy is not really just about um not the evolving Secrets privacy is a form of security so in reality the Privacy branding is not great um we really should be thinking about privacy as a form of security privacy is security of groups and the security of civilizations uh so it should not be dismissed as kind of an optional nice to have this is fundamental privacy is fundamental to security now there's really good uh political progress over the last few decades the original crypto Wars enabled encryption uh to be uh disseminated around the world we have pretty good de facto worldwide communication many people around the world communicate freely even though they're States technically where um people started communicating over the internet in a more free way than they can communicate locally and that was an amazing uh really good result uh globally and there are now you know strong proposals against um ai-based uh social scoring and so on um like what we've discussed now but all of that stuff is not uh in place yet and of course good policy can reverse in crises so even if you build up a very strong safe government you can still get into a problem when any kind of major crisis like a war or a serious safety threat um terrorism and so on can dramatically change the the positioning of governments so you can't just do policy though it's necessary so let's talk about technology for a moment the way I think about it is this if you want to coordinate actions between people um you need to be able to have discussions and plan together and if you want to do that then you certainly need to be able to communicate you need to be able to talk you need to be able to write and so on so if we get the bare minimum that we have to do is to establish secure Communications globally and then that out of that on top of that we can create coordination tooling and then be able to coordinate actions with people so let's talk about secure Communications I'll go through a number of examples of the things that we need to uh secure uh all of these things are not good enough yet and they have major um major holes uh and points of centralization where parties can take control and and change how basically put in place some kind of a way in uh control system so first off just the ability to move around packets on the network and being able to send and communicate between any two devices or any two programs on the internet we should be able to do that in a secure privacy preserving way today you can't really do that you can go really far by um in certain kinds of networks but you can still make all of the metadata about the traffic going into those networks um be seen and so in order for these things to really work we need a huge fraction of the traffic globally to be going through those networks and so they need to be good enough and working off at scale and be fast enough that they become the default it's just not good enough to have these um kind of not really secure structures yet now the good news here is that we have had a ton of progress over the last decade and a half um building on the successes of things like tour and igp and others we now have new kinds of mixed nuts we have very interesting new proposals for using through knowledge proofs and and homework encryption and so on to do routing of packets now that might be way too slow but we'll see over time if that becomes um uh relevant and then lastly you today states can remove entire sections of the internet on and off um and you need to be able to kind of circumvent that in some way and so one way you could do that is to do kind of point-to-point radio links although that's kind of hard satellite might be an extremely good way but you need to build a big enough constellation and have that consolation be self-sovereign or decentralized in some way and today we don't we don't have that uh talking about uh internet infrastructure talking about DNS for a moment uh most websites and most applications that you ever interact with have this like huge central point of failure which is the DNS names so that is a huge area of control where all a party has to do is is block certain domain and because DNS is just such a useful easy to use um successful system it becomes a linchpin problem where you could have a super decentralized system and you have some critical part of the install path that requires some DNS resolution and then suddenly the whole thing doesn't work and so we really need to get to a point where we have proper decentralized naming uh we and good news here is we have had a ton of progress so we now have good blockchain decentralized naming systems things like ens and supplement Mains handshake and so on but we need to be able to use these um by default on browsers and operating systems so today all of these still ride on the normal DNA resolution Pathways and all of those are breakable the ca system so today the CAC SM is kind of pretty uh there's been a lot of improvements but it's still very messy and you can still kind of um fake a lot of certificates and you can um give certificates without full transparency and so on so we really need to upgrade the structure to create a much more um uh resilient system where you can see all the certificates that are being issued um and you have a transparent way of of certifying that something was generated correctly and ideally you should be able to have certificate Authority that lives on a blockchain that doesn't isn't actually run by any party and just automatically can sign certain names based on so you can link this with this kind of system and you can now get to like a like a properly secure point-to-point interaction um using the current standards uh but building it entirely on a blocking system uh then after that you need to be able to move around um websites and web apps um this is the area where we've been mostly focused being able to move around entire bundles of content so um things like like entire um entire websites entire mobile apps and so on uh moving move them around is a huge content bundle and be able to content and address it make it independent of DNS and so on uh as a this is how the the Catalan referendum uh signal polling locations to folks uh using this and that was like an example of of testing this now in that example the DNS site Got Hijacked both the original polling site and the ipfs Gateway got blocked but you could use uh standard ipfs protocols to then circumvent that and and access it however a more sophisticated attacker could have just blocked all the routes could have started doing pack inspection and so on so we're still like nowhere Out of the Woods you also need uh to upgrade browsers you need to be able to have all of these browsers and systems be able to use these protocols um to to hook into these new upgraded DNS certificate authorities and so on uh and the app stores are this other uh choke point where you know thankfully in Android you can have these other app stores that you can hook into and install your own applications but you can do that in iOS at all um and who knows if those would remain open in any kind of like major threat uh area so again in any kind of Crisis um you end up in a position where all of this kind of stuff may be rolled back uh so I encourage you to think about like just enabling basic communication applications so think of one-to-one private conversations one to many broadcasts many to one meaning reading lots of information many to many group chats and forums and enabling all of these to be privacy per serving that means read and writer privacy um and the ability to not attack that that activity is happening so things think of email messenger large group chats forums and so on uh on top of that you can start building more complex coordination applications like economies payments contracts and so on organizations like dials Dax and whatnot and one other major problem is Hardware so today we have a very small number of vendors phones are extremely hard to make and our demands for that kind of product are so high that it's extremely difficult to see some kind of privacy oriented system uh emerging we might have some systems that uh we might have some providers that could generate some devices that are that have some other kind of form factor that doesn't try to do everything a phone does or we could try to get all of these vendors to sort of commit to strong requirements around Global censorship persistence and resistance to manipulation and so on however all of these corporations can be coerced by by various States uh we can we there's a ton of r d that we need to do uh and there's some really new interesting Tech Frontiers that we will talk about today around zero knowledge proofs NPC fhe and so on that could be used for uh for these systems last but not least an innovation cycle is key to all of this so not only do you have to build a technology you have to get the funding required to fund all of these operations so having an innovation cycle where you can build applications make them successful in markets generate revenues and take those revenues to fund more of this r d and development is a key component of making this accessible so it's not you can't just go and like work um because if you don't if you aren't successful in the market you're not going to be able to hire enough people uh to build all this stuff so overall we've had a lot of progress uh and so we're in a much better position today than we were five years ago 10 years ago 20 years ago but we have a long way to go before we can be or will improve just given the current Technologies so uh good luck with all of this uh let's work on this together uh I think that we though the this feels hard and scary um is very achievable uh we just have to be focused on achieving certain specific goals let's focus on securing Communications let's get to point-to-point interactions uh totally in a reader and writer privacy um sort of way and then on top of that we can bootstrap all of the other kinds of applications thanks very much and have a great Summit [Applause] [Music] foreign Administration um all right we are actually about ready to get into the meat of today uh with panels and and more Keynotes but before that um I am going to do a very quick overview of the UPA the universal privacy Alliance so you can learn more about what we do and then if you represent a project and would like to join please do approach us afterward all right on this slide we have We have basically all the projects that are currently involved with the UPA we're still very nascent so a lot of things are changing we're trying to recruit more members to join us um we're actually a little bit tight on time today so I'm just gonna read out some of these names um from starting with the L ones we have zcash Mentor Network Elio mobile coin anoma secret um and Oasis Network and one level up we have Orchid Aztec and also status is is not an element and L2 but they make a lot of very important privacy-centric applications like the uh like the Nimbus eth client and then underneath all this on the network privacy layer we have Nim currently the only project I know of working at this level perfect thank you thanks for reading my mind cool so we have a website called privacyalliance.com and um to join the the UPA we all are privacy projects with slightly different goals slightly different implementations if you do want to join the UPA you do need to align off on three unifying principles the first is that privacy is fundamental it is a basic human right the second is that privacy tools are normal we're in an age where oftentimes when I talk about privacy with my friends the first thing they say is what do you have to hide why do you want to keep this these things private but what we at the alliance want to do is to change the narrative into one where we say privacy is normal surveillance is not and then finally privacy by Design privacy by default it should not be difficult for people to opt out of tracking and ideally people out into tracking in exchange for something else instead of having to to jump over many Hoops Hoops to jump through many Hoops in order to opt out of tracking so these are our three unifying principles now the overall goal of the UPA is to combine our resources our financial and our intellectual resources in order to fight to be able to keep building privacy technology for those of you who are familiar with the history of this the US government some decades ago fought so hard and relentlessly to keep encryption out of the hands of the public it was through very obstinate individuals among them Diffie and Hellman who some of you have worked with with their work they kept doing math and today what we're doing together as as the EPA is to fight for our right to keep on doing math and to build the tools for people to live freely to that end the main actions that we commit to undertake together are firstly to set up a legal Fund in order to pool our resources we're spending a lot of duplicated efforts various at various venues of the world trying to fight to do our work and also we will work together to educate and Advocate um for for privacy for example at our launch event in Bogota last year we invited Edward Snowden to deliver a keynote and we helped educate a whole room full of people about the importance of privacy and the things that uh was running through his mind as as we observed the world or around us today and then finally we will work together to make public statements so when tornado cash happened last year we didn't have such an alliance so so there so some groups put out statements some groups did not we didn't have we didn't present a unified front and and presenting a unified front is how we win uh some of these very difficult debates so if you do have any interest in joining the UPA please reach out to any of us later on or we do have a sign up form as well on privacyalliance.

com so it concludes my introduction to the UPA we're going to move into our first panel um Can my panelists please come up the first panel is called how to build with privacy first and make privacy scalable we'll have Chris John somebody from Aztec um Linda Kenny and Travis all right Okay cool so welcome everybody we have a panel of five different people representing five of some of the leading privacy projects very excited to start digging in um I'm going to let them introduce themselves before we kick off cool um hi I'm Linda head of ecosystem I Oasis very excited to be here hi I'm Chris Beck I'm a principal engineer at mobile coin uh I was primarily responsible for the design and implementation of mobile coin fog which is a privacy preserving system for mobile devices to get their balances without uh Cloud servers being able to figure out who was paid and who received which transactions hi I'm Kenny I'm one of the co-founders of Manson Network and I'm specifically focused on the operations side hi I'm Travis Canal I'm from Orchid and I run product and marketing for them and orcid is a bandwidth Marketplace that has a VPN running on top of it hey I'm Bruno I run ecosystem Partnerships for Aztec um we have a product live on ethereum L1 today that lets you interact with L1 D5 protocols completely privately and we also are developing a zero knowledge domain specific language called Noir awesome thanks everyone let us they're trying to understand mean to build privacy first if any of you have a comment please launcher yourself and I think I'm going to start off with Chris I would say that building for privacy first means that you think about privacy from day one you don't think of it as something where you do it later and oh were you or you do it later and sort of Kick the cane down the road um when I think of uh okay I mean I don't want to give examples of people who Kick the Can on the road but you can tell when um when a project like has to change a whole lot of things because it turns out there are big privacy problems uh building in privacy from day one means that you're thinking about privacy and also the how it impacts scalability because uh private services are often very difficult to scale or can become a lot more complicated because if you know who is downloading what or if you know uh who is doing or if if you want to make a system where you can't know who is downloading what let's say then that's going to change a lot about how the system can work and how data can flow in the system those are it just means that you're building for a future where everything is working or the Privacy is working and you're scaling to lots of users and building something that's useful and going to change the world like that you have that kind of a vision from day one yeah I think something Chris said there uh that resonates with me is like ultimately at least for Aztec and some of the other projects up here we're building open source infrastructure the point is to give developers the tools to things still working uh the point is to give developers the tools to build whatever they want using at least brass Tech are open source infrastructure and so it has to be privacy first if you kick the Privacy can down the road then that infrastructure becomes difficult to build with difficult to reason about uh difficult to incorporate and you end up actually missing the point of building this open source infrastructure for developers to you know just use easily if they can't use it easily if the devex isn't good if the ux for um for building with your with your open source infrastructure isn't good it is really hard to get that adoption and to get people to treat privacy as the first class Citizen and so people just end up taking the shortcut and not actually using uh privacy preserving tools and also um if I sound a little shaky it's not because I'm nervous I'm just a little cold but uh I think another another aspect I think this might have been something that John had brought up previously at maybe the first EPA event that I I thought like really resonated with me it's like what are the implications of privacy first especially in a world where app applications are privacy applications are secondary to the actual infrastructure right you get this sort of selection bias where you have these narratives that we have today which is hey privacy is only used by you know Bad actors money launderers etc etc uh the reason is because or one of the reasons is because the the entry barrier for using privacy tools is so complicated maybe it's a financial barrier right because you're generating a zero knowledge proof directly to the browser and the gas fee is already like 100 200 bucks right and so 100 200 bucks already cuts out a majority of users who just want to use privacy for uniswap transaction that is 20 bucks right so so that that is sort of a selection bias and then another one is the user experience right um it's it's something where if if it takes you five extra steps in order to enable privacy for whatever use case you're trying to go for then you need five times as much of a need for that privacy than just like oh you know what I could just generate another wallet address and try to not link that to my identity right and I think people are going the let's generate another wallet address way rather than let's use privacy tools way and so the people who end up using the Privacy tools kind of self-select into that pool of people who are like oh I really need this for some heavy Financial reason and yeah it just kind of you know that's that's a great point the negative selection the adverse election to be fair it wasn't my original idea John had mentioned it before right I think the panel is really elaborated pretty well about what privacy is privacy first is specifically I think I always is we're thinking about privacy along those lines as well but we also have our own thinking around like if we look at web 2 uh you know we transition so smoothly from if you open a website like you know we transition so smoothly from HTTP to https that without most people even noticing it and these days if you open website that open URL that is HTTP I think you will get automatic notification from chrome or whatever browser you're using saying hey you really want to continue on visit this website because it's not encrypted it's not say we strongly recommend not so I think we think um that's what the web 3 should look like in the future that privacy is not just some sort of bonus or nice to have some afterthought you should become a default setting at least being able to configure construct confidential smart contracts should be in every slow developers or every blockchain crypto developers toolkit that they should be able to use you know so they can construct smart contract be fully public be fully private completely you know up to their users whoever they're serving up to their users needs versus just you know have what we have currently just because things are the way they are doesn't necessarily mean that's how things should be in the future or that's already the most best or optimized you know way to do things so um yeah so we hope that some point in the future you know I always were definitely trying to move towards that like be at you know providing this uh this previous solution should be every developers toolkit hopefully that could become a some sort of default tools everyone uses whether or not they are you know building a private privacy dab or something but they should have the flexibility as to how they construct their smart contracts this is a great point I think one of the challenges in privacy and and and integrating in our everyday tools is there's a chicken and egg problem right you need to first get people to care and to get them to care they kind of need to use tools that you know show them why partly if it's chicken and egg it's difficult which is why we're here to work on it um if if we can uh double click so I'm imagining I'm a Dev in the audience I'm a builder like as I start thinking about building in privacy features into my product how do I think about what things I want to keep private like what is it identity of my users is it the relationships between them like what exactly should I try to keep private like is there a ranked order of priorities yeah I mean I can take that I think um you know also just kind of backing up I'm I'm a very product kind of marketing background and so I was on web 2 I was on the other side I was a big ad buyer so um I was actually using all this data that was being collected and it is actually pretty hard to run a marketing operation and you know a website and all these things I mean look what happened to MailChimp you know so you have to think about you who do you want privacy from oftentimes people jump into I want privacy you know I want like perfect privacy from all governments which is a very tall order but if you look at like what happened to MailChimp I mean now you have your email list is out there on the the dark web right and now all your users are sort of or people that have been interested in your website um are available to almost anyone for a pretty cheap price and they can do different things with that you know is your web server logging IP addresses right now like right now is your web server logging IP address it's like why you know maybe save if you really need to see geolocation maybe have you know parse that IP address into a city or a state so you kind of know where that is from but the IP an IP address is just way too much information to be storing somewhere anywhere even if it's with AWS that information can be subpoenaed and then you know are you using ticketing systems are you using you know all these things kind of just grab user data and store it and you know the challenge is then well you know it's just so easy to use use those things everybody wants to intercom everyone wants a zendesk everyone wants like a support ticketing system everyone wants an email newsletter list everyone wants a functioning web server um but uh you know those are some of the things I think about in Orchid outside of the product realm but just like how you're kind of running your organization and what information then can be linked to your users not necessarily people that are actually using your app but just you know now there's lists out there of like uh you know people that might have visited your website and different things like that but they're so useful they help better yeah I mean coming from working from uh into it on the QuickBooks brand and doing really large media buys I saw the move to mobile because mobile no one you know everyone knew how to clear their web cookies but no one really knows how they change their advertising ID I think people are getting better about that but typically when I was in that industry you know basically from the beginning of the phone to the end of the phone everything was tied back to that device ID it never changed no one ever changed their ad ID and uh and then Google was using their crazy AI stuff you know by when I left into it half of my money was going into just Universal app campaigns which is essentially a black box that you're putting money into the only thing that humans are still really good at is creative so the bidding the targeting the segmentation all that was handled by robots and it was a creative you know it's like what uh what images and what what words you're going to use to describe it and how you're going to kind of Chunk that together but gpt's been doing a lot of my creative lately all right I'm a plus user or anybody else have hot takes yeah I could talk about that um when you're trying to think about what things should you make private one way that I like to think about it is that uh there's no one person who owns the definition of privacy or what is privacy privacy is kind of like a social norm and when you're building a privacy technology you're trying to like offer a better social Norm to the users so when I think about like what kinds of things should be private in a project what I try to think about is like how is this going to work from the user experience like so so like for example with signal they communicate very clearly that you know when you send an end-to-end encrypted message whatever you're typing in that text box is going to go to your friend no one else is gonna be able to see that except your friend and that's a message that users can understand it's not it's not only important that your technology works and does what you say it's really important that the users can understand it that you can articulate it in a way that they can understand it and then use it correctly without like thinking something will be private when it's not because then that's how they can get burned um telegram yeah yeah so when I think about like blockchain stuff I think the state of the art is that uh you should try to protect the recipient and you can try to protect the amount there are projects that are able to make it hard for people to figure out who you are sending money to and also protect the amount that you're sending and there there are different threat models in which you can do this and there's lots of um but there's there's lots of like different ways to think about what it means to do this uh but ultimately like I try to think in terms of like the user experience like if I was going to explain to like my mom how to use it what I would say is something like whoever you type when you send money to your friend here whoever you you fill in the to field there that's going to be private only you and your friend are going to know that this happened and you want to be able to articulate something like that and for it to be true uh so that's kind of how I think about like what should be private yeah I think I I totally agree with with Chris that I think I actually want to double click on this user-centric user first approach I think that should be our guiding principle in the in the blockchain world in the sense that I mean I don't really have a specific packing order as to which Fields should be private which field should be public I think it all up to what developer wants wants to provide for their users let's say if you want to solve some sort of like you know front-round attack or sandwich attack or MVP problem in D5 you probably don't necessarily need to encrypt the receiver sender address you probably just want to hire some sort of like trading parameters because those users divide users don't necessarily some user don't necessarily care that their address being reviewed public because that's how things are these days but they do care that when they make a trade you know they don't want other editors or some other people have been bought you know being scanning the network be able to run around their trades so that's just D5 and then you also have institutional investors who want to be involved in D5 a bit more than they are now so they are they do care about you know especially those whale those institutional investors they do kind of like they are concerned about um their trades being reviewed to the public so they care about you know whether these address should be made public or not and you also have like in some you know like an ft let's say when you do the nft auction you know to make that a little bit private private it's not necessarily about people participate in nft option don't want people to know that they're in the in the auction they actually want to you know be able to participate in some sort of exotic auction mechanism um you know besides just the what we currently have so it's really about kind of like being user first and think about whether introducing privacy can improve the end user experience right so not a blanket everything must be private focus on the why certain use cases certain threat models will have different uh more important aspects Bruno did you want to contribute yeah just one thing I feel pretty strongly about is like not being too prescriptive about how a user should interact with your software like open source developers want to come upon your project really quickly understand what's happening and then use that to do something with it like if vitalik and the rest of the ethereum the early ethereum team would have been really prescriptive about how to build an amm like maybe uniswap wouldn't have gotten built or wouldn't have gotten built like that and so I think that's one of the challenges with open source software and with privacy specifically is like how do you build uh something that's really usable that's really easy to incorporate without being very prescriptive about how someone should be building um that's how you're going to get like the most unique use cases the most uh cool and interesting use cases the use cases that no one is expecting that will kind of come out of this open source software I think also like what everyone is saying here is like the the technical answer that we always don't want to hear but it's always true which is it depends right like that's that's about as clear as you can be and I think like when it comes to data and what what sort of information you do want to keep private and you don't I think there's like three broad categories of this right when you're thinking about it from your own application development perspective and the and the prosperity of your own application now and in the future the first category is that mission critical data right this is data that you absolutely need in order for your application to run and I think people have touched upon this already right one other example is like the the amm right like you can't possibly have an amm running if you don't know how large the size of the pool is and how the ratio of the trades are going right so that's Mission critical data and so if you're building an amm you probably can't really obfuscate that information um and then the second one is um data that enhances your product right and this is more so on like the marketing analysis side right which we see where it's like okay where are all the top users coming from where are they clicking what are they interested in what's the feedback et cetera et cetera and then the third category of data I would say is just like uh pseudo valuable data right these are this is data that you think is valuable but then you end up never looking at it right so when you have like Google analytics for example right and you're looking at like the countries that use my application and there's like a hundred rows you probably never go past the first ten right so like why do you still keep the other 90 and so like I think like these are sort of some of the Frameworks that can help you think about like and and reapplying it to like you know the own data and the own on-chain activity that you're tracking right like how can you apply obfuscation to certain aspects that aren't as valuable and then also I think we'll touch upon this in a little bit but like viewing keys right like thinking about how can you recreate the data collection process in a way that's very fair to the individual and I think like that's really an ethos of web3 right like how do you empower the individual because we all say data is digital gold right I mean bitcoin's digital gold data is digital I don't know everything's digital gold these days but um the point being that like it is extremely valuable and in traditional internet spaces right tech companies right all that value all that power is captured through the centralized entity which then uses that to create more value for the entity which then goes back to the shareholders not necessarily the individuals right and I think like for web 3 that gives us an opportunity whereby we could potentially still find a way to you know extract valuable data that can help improve the value of the product but extract it in a way that also maintains some type of fairness to the individual right and I think like maybe viewing Keys could be an opportunity for that but anyway that's that's you know maybe a further conversation great um I think Chris also in our panel prep did mention something I thought was quite interesting do you want to maybe double click into stealth addresses I think uh one thing that I think is really uh important in terms of like establishing uh concepts for blockchain is and for privacy and blockchain is to try to think about the difference between pseudonymous um Technologies and Anonymous Technologies and how these things are different like the idea that you can have a pseudonym in Bitcoin which is your public address but all of your activity will be tied to that address and then the more and more activity you have the more and more likely it is that someone else will be able to figure out who you are and then figure out that you did all this other activity um stealth addresses are a technology that a number of privacy Tech of uh privacy and Technology chains have uh used to try to prevent this kind of linkage so that each interaction or each time you receive a payment it's going to a different address and like uh not not every like privacy blockchain uses the terms stealth addresses like I don't think zcash specifically uses the term German stealth addresses but they have something sort of equivalent in their chain where um sort of this this there's a key that's pseudo random across all of your different transactions it lands on your TX out of field um and yeah I think I think one of the like like for somebody who sort of new to the field and hasn't uh is sort of getting initiated into into what privacy enhanced blockchains are like I would say understanding the difference between the pseudonymous and these Anonymous Technologies and how they can protect your activities is just like really important because I think most privacy um Advocates have sort of agreed that Bitcoin is not private enough to be widely adopted for payments like it's not a good thing if you know whenever I go to the grocery store to buy groceries the grocery store can see how much my rent is uh because they can see my address right that's going to cause all kinds of weird societal effects uh if if people can learn this much about each other this way and so having some kind of way to use this system in an actually Anonymous way where not all your activity is linked together is just really important and also on on the note of stealth addresses I like to do this exercise a lot when we're doing these types of talks um how many of you guys use metamask raise your hand all right so keep your hands up now put your hand down if you only have one metamask address all right so here this highlights a point right I think 99 of you all kept your hands up the point is that a public address you're already trying to you're already trying to extract the value of a stealth address by proxying it by creating multiple different wallet addresses I'm assuming right that you're creating all these multiple different wallet addresses because you don't want everything linked right and so like regardless of if you think about like privacy or not I think like in the back of our minds right it's already there and so like the stealth addresses is just like a much better user experience because then you can truly have one address that can completely Shield all of your transactions from varying parties so the grocer doesn't see your rent yeah I think what you describe is trying to build multiple identities and it becomes really complicated to manage better is if at the base level uh you're protecting us um are you guys ready to uh battle it out so uh my next question is you know in the UPA slide there were a lot of logos there are a lot of you right if I were a Dev how do I start thinking about which ones are are better for me to try and work with how do I make the trade-offs ETC we can go in any order I guess I'll go first um yeah one thing that we're thinking about at Aztec is there is this total addressable Market of developers that can actually use a lot of the the Privacy tools that we and other projects here are building uh specifically like the zero knowledge domain specific languages many of those just require a certain type of person a certain type of experience a certain type of thinking um we like to say that it's sort of many of these require a cryptography a cryptography brain as well as like a regular just software developer brain we want to make that a lot easier we want to remove the need to have to be a cryptographer to incorporate zero knowledge into your programs we want Noir our ZK DSL is highly abstracted and the point there is that you're just a developer with some experience writing in like a rust or something similar and you get a similar syntax that you're comfortable with you're familiar with we abstract away almost all of the cryptography to make it really easy for you to incorporate this into your application like if you believe zero knowledge proofs are gonna open up the door for a variety of use cases both in a blockchain context and outside of a blockchain context it needs to be easy for the regular software developer to incorporate them into their applications inside or outside of a blockchain context so that's how we think about it we want to make it as easy as possible to sort of expand the total addressable Market of developers that can actually use these tools to build cool stuff with it thank you yeah orchid has an actual VPN application so it's in the application space which is a little bit different from you know developers that want to use some of our Tech and we're working on that more so we have more useful things for developers but so we're trying to encourage more people to be a little bit more privacy conscious use our VPN product that's built on decentralized Tech so you're seeing a user of orchid would would be able to do what a user of orcid can Master IP address so not so much you're not serving as an intermediary between users and and builders yeah I mean uh we have all of our stuff is open source and there's a lot of pieces of our tax stack that we haven't talked about a lot of um that we're going to be talking more about that can be useful for other decentralized projects how we're handling our payment system and some other things that we've been working on but for now it's like uh yeah we have a VPN application that not only can help sort of Master IP address to give you some a little bit more privacy from your internet service provider but also in the case of a hostile government that is totally blocking access to a lot of different websites we're helping people you know get access to the open internet so that they can actually use Twitter and send reports out from places like Iran thank you I have to go in order okay I guess you know I'll just I don't know I'm a person of pattern behavior so um uh so with Manta Network I think like a lot of the a lot of the sort of Technologies a lot of the value propositions are already described we don't do anything related to vpns so you know uh not not really in that space but uh we'll fight later then okay yeah bring in different weapons to the arena here um but for myself or for Manta network uh one of the one of the I think audiences of developers that we really want to focus on and I think like this is something that should be kind of an invitation to more of like the broader uh privacy ecosystem right is um right now web3 I think is suffering from a major problem we're just eating each other's pie and the market size is very small and in order to bring in web 2 users the friction is very high even for web 3 users oh my gosh you're telling me I have to switch to this layer to and then move my you know eth to this layer two and then I have to wait 30 minutes and all this stuff by the time the eth has moved over I've already forgotten right and so like the user experience even in web3 is pretty complicated and so the question right like we all talk about better user experience better user experience but like how um and so from our perspective right like I think one of the challenges that we really want to tackle is how do you create more of like a a web 2.5 experience and when I what I mean by that is essentially like a hybrid user experience whereby you know thinking from first principles what when do users need a wallet address when do users need to interact on chain when do users need this versus that versus like how do you bring on more users onboarded into web3 and I think like those two questions or those two categories of questions uh can be independent right because if your goal is to onboard web 2 users right you need to build an experience that allows web 2 users to be easily onboarded which may not necessarily match the experience that you're building for purely web 3 users who are like oh I don't care I can switch over to 10 layer twos and I'll remember all of it um that's not me but um you know for us right like thinking about building out apis sdks that can actually be used by developers who aren't really familiar with the web3 space and having that on-chain privacy aspect connected into their application from day one such that when users come in right we say oh everyone enters from Bitcoin or everyone enters from like a centralized exchange why not everyone enter from a privacy tool and they have privacy from day one and then they say hey why doesn't this blockchain have the Privacy requirements that I'm looking for instead of oh maybe I should go out and look for privacy so if you are a developer who is you know building a mobile application you're looking for ways to integrate into web3 right like definitely check out our apis and sdks and happy to talk more about it but what exactly could we do now with um with Mentor Network yeah so uh we've been testing this out with a project called uh Moonbeam I don't know if you guys are familiar with them or not they're also an evm compatible project and I know from day one with with Manta what we were thinking about was like how do you build privacy as a utility I think that resonates with a lot of sort of the the themes that I've been kind of talking about today which is you know like we we have to make it as cheap as possible so it's accessible as possible we have to make it as much in the background as possible and so one of the things that we're building with Moonbeam using our apis is remote transact so Moonbeam developers are able to for example build smart contracts on Moonbeam and then use those used Manta networks you know privacy enhancing features for lack of a better term uh remotely through Moonbeam evm and they can remote transacts so that they can add privacy features directly through Moonbeam applications but all the Privacy functionality runs in the back end through Manta Network and so like that's kind of the the same sort of experience that's similar to Aztec connect ish um not exactly frankly I don't um fully I'm not fully aware of what their partnership is trying to spark a fire yeah yeah but five minutes left yeah the way Aztec connect works and I actually see uh several people in the crowd that are actually building applications using azteconnect if anyone wants to come up after I can introduce you to these projects and they could talk a little bit more about their own development experience um but the way asset connectworks is you're basically as a user um hiding in a crowd of other users and so sort of to Chris's point about I suck at pronouncing this but pseudonymity versus anonymity um like you're sort of just hiding in a crowd so if all of us were to deposit one in task to connect and I wanted to do a transaction on Lido to stake my eth um you would see that the Aztec roll-up contract has settled one transaction on ethereum on Lido for one each but you won't know which of the five of us it was that actually did that interaction and so it didn't sound super similar to what Kenny was describing but I'm just not that that familiar with the project to be able to say yeah I think that sounds more close to like a shielded pool right if you think about like a utxo model you have transactions that are happening in that shielded pool but you don't really know who what transactions are linked to who yeah hey so I uh to go back to the original question of like if you're a developer how do you evaluate different privacy blockchains how do you decide what to build on and so on I would say one of the things that I try to do when I look at blockchain projects is try to understand what differentiates this product what sort of Niche are they going after because there are a lot of projects but a lot of them are actually like differentiated in in sort of subtle ways and you have to kind of read and sometimes talk to people to try to figure out uh why one might be better than another for a certain application another thing I look for is uh if somebody is saying that they have a privacy property they should have a written threat model somewhere and you should be able to read and understand like if you're a developer if you're a technical person uh if somebody's saying that they have they have privacy properties but they don't have a clear threat model that's in my mind that's that's like uh sort of a like a like a yellow flag or something there may be a threat model there and you might have to talk to somebody to figure out what it is but uh it's hard to build on top of something if you don't really understand exactly what the guarantees are what the developers think that it does uh like in very precise terms um I I think so so for mobile coin for example like our niches that we're going after payments we want to be the best possible way to for people to pay for things using blockchain technology and a lot of blockchains are not focused on that like we do not have Smart contracts we're not super interested in doing that right now because it's not required for building the best possible user experience for private blockchain payments um yeah I think um like like for mobile coin we don't think of ourselves as competing with a lot of these other projects we're largely competing with like credit cards I would say thank you um cool um yeah so I always is our positioning has been pretty clear you know to the uh developer Community out there um you know we provide the Privacy layer for web3 and we start with EVS solidity because that is the biggest developer group out there in in the blockchain industry but we're not stopping facility we have web assembly rust also on the roadmap and then soon to be released I mean for everyone to use uh and uh but in terms of providing conditionality to solutely developers as well to all the devs building on evm so always is we're currently using uh trust execution environment I think there's going to be a panel probably two panels after this that is basically talking about the pros and cons risks benefits of using that technology that privacy producing technology I know ZK is very hot today and we have we have you know two palettes um very advocating very very much educating for ZK I personally do like ZK technology as well but I do want to point out that all these privacy technology whether that secret Hardware or ZK or photomorphic encryption those are not mutually like strictly exclusive they can be very complementary to one another and Oasis the Privacy layer will be meant by privacy layer is that you know so so the developers you know you can be building that or maybe you're already operating adapt let's say on BNB Network on ethereum and polygon on all the you know any evm network that where you see users where you see it created with no basically what depth of our cares most about you know by using Oasis product solution you actually get to stay where you are you don't get you know you don't necessarily need to migrate to Oasis you know we're not asking you to migrate at all you know you stay where you are because that's where you get most users and liquidity that's how you get momentum with your applications but by constructing the smart confidential smart contracts on Oasis Network you get to add confidentiality to the part of your dab that you believe that privacy could bring benefit to the end user experience and that's it it's very simple and the reason you know we want to using trust execution environment at the moment is because it is best in terms of you know suitable for general purpose Computing like you know ZK is great um but as far as I know at this moment you know ZK has a limitation when it comes to you know can you serve like arbitrary computation or the stability sometimes they're even cost involved as well so Linda I want to jump in here I was on your website yesterday on the blog and there's this idea of a privacy side chain is is that one of your core kind of products is that how that's the Privacy layer okay that's the same product yeah Kenny is that similar-ish to what you described or not so much I don't know I didn't read the blog all right cool um enough with fires I think I think so um for coming speaking today and they'll be available I think throughout the whole of this session so please approach them if you have any questions [Applause] [Music] foreign [Music] foreign [Music] foreign thank you foreign if you know who you are come up otherwise it's Travis guy Josh and Ahmed where is guy and Travis we lost our panelists anyone from Secret around Travis guy it's not like a mother I'm not a parent if anyone is a parent here's just how it feels not motivated laughs [Music] foreign [Music] thank you I'm Ahmed I am the general counsel of nim I'm Josh whitehart I had growth at the electric Coin Company and we invented and support the we support zcash ladies and gentlemen this is how to beat surveillance capitalism and reclaim your privacy it is past five at my side of the world in Europe so I think we could actually advocate for a drinking game water of course we need hydration each time I say the word surveillance capitalism it is going to come up quite a lot don't judge me for it so all right let's start off uh privacy is usually associated with negative scenarios or only used as necessary given the level of surveillance capitalism and the impact on our digital lives it seems that it should actually be viewed even more negatively and this does not seem to be the case right uh people object but nothing happens no we joke about how our mobile phones is listening to us you know and social media ads popping up based on our words and even our thoughts um but Society hasn't fully revolted saying this is not okay so how are Enterprises actually getting away with it are we actually rationalizing the situation with resigned cynicism or are we swayed by the propaganda that this is actually technological inevitability maybe you can hear from guy and Josh uh yeah sure so uh well I guess you know you touch on cynicism I think the fact that people are being a bit cynic about it like um we don't control our data or this whole thing is messed up you know I've uh um we're pregnant about to have a baby we're being targeted with diaper ads and all that so I think those things are actually positive in the sense that uh that kind of like bottom up bubbling up is always like a preload in my opinion to a revolution now look like the public key is decentralized it's like hard to get it's it's hard to reach a threshold a threshold where like the majority of the people just rise up and do something but I think those voices are like empowering us like the people like in in this panel in this room in in everything that we're doing to know that like we're on the right track and I think it's really up to us to actually give the people give the users the Alternatives where they can come up and then say um then they can actually take action I think right now the problem is that like all of these are like still still being shaped up still being in place but you know Joseph look at this panel between like Z cash working on uh private payments um private monetary policy uh between uh Orchard working on a private communication Secret working on private computation like eventually those technology is going to read some critical mass and we will be able to build better Alternatives and with those better Alternatives I think those voice I think that's where the revolution happens like I don't think this is the kind of Revolution that we see people like storming the gates or something it's just a quiet Revolution where there will be better alternatives yeah because revolutions are bloody and ugly and take a long time um and people have to put a lot at risk and so I think you're right but fundamentally I think it's just in a misalignment of incentives right so a few of them um one is like time and time preference so as a user I want to have a media gratification I think I saw in the paper this morning or something the paper on the web this morning that's how old I am um where like Amazon is increasing its capability in terms of real-time deliveries to your front doorstep we want that immediate gratification we're willing to trade some some long-term damage um for for time so the companies may not have the same time preference social media sites it's fine they can accumulate data over a longer period of time in order to be able to use that data so they swap you the incentives are messed up and it kind of leads to a tragedy of the comments right so you as an individual are making a decision to make that trade and then in aggregate all of us are making decisions to make that trade and then the social media companies or the the web 2 companies are able to aggregate all that data and use that back against the individual in order to try to manipulate Behavior um and maybe the third is just that it compounds over time right so it's a misalignment of power so as an individual you have a power to make a certain decision a certain period of time but the company that's accumulating all of this data over a long period of time is accumulating power exponentially in their ability to kind of understand you and who you are who you are as a um even kind of people groups and groupings in order to try to to construct Behavior so I don't think it's like propaganda necessarily or evil it's capitalism but then it's incumbent on people to create better options that better align the the incentives mention misalignment of power and I think a lot of people outside of this room you know especially general public my mom and dad your mom and dad friends and everything they are a little bit reliant on the government to help them you know reclaim their power however it almost seems like the logic of surveillance capitalism is actually ingrained in many governments I'm at you litigated the first criminal trial to challenge bulk metadata collection by the NSA under Section 215 of the Patriot Act and Josh I think you have personal experience in building something that the government ended up being very very interested in which led you to be on this side of privacy today our government's actually truly motivated to implement preventive measures against surveillance capitalism given the overlapping objectives well um I want to find out what you were building but we'll save that for later but absolutely not governments are not motivated uh and have no incentive uh to stand against surveillance capitalism irrespective of what your Congress person tells you they will not use those terms they will not say that they don't want uh data holders to hold our data what they might want is a separation of uh or breaking up some of the big tech companies into smaller companies but none of so far my review of literally everything that I've reviewed does not reveal that any uh government's representative actually wants any any of these entities to install or instill privacy protections right um so the incentive is not there um but uh what and as a result you know like part of if we just step back for a second right like it turns out that um and this kind of goes to what um Josh was saying earlier um two of the greatest inventions of our time are the telephone and the internet right and they also happen to be two of the best surveillance devices right and so we would have to get rid of the internet entirely right to to block the internet uh from our threat model of privacy and anti-surveillance um the cool thing about web3 I think the cool thing about uh more generally uh just decentralization of blockchain um is that it changes the incentive structure right so as we chat and uh talk to each other communicate uh We Leave Behind digital traces um with third parties these third parties are big tech for the most part right and the problem is that big Tech is incentivized by capitalism or surveillance capitalism to uh store Harvest process and uh buy and sell your data right um what uh what this ecosystem does is change that incentive incentivization model from one where we basically prey on user data to one where we satisfy where where our incentives are aligned with uh something else now does that necessarily mean that web3 is uh inherently a private uh a privacy preserving uh ecosystem absolutely not in fact we are an incredibly transparent ecosystem by the very nature of what a blockchain is right but all that means is that we have to try harder and uh to to to uh to protect privacy right and the few groups that are part of the EPA are groups that are doing that um and just stop talking now because Josh is giving me a look there's no by the way a little secret I'm actually blind in my right eye so I can't give you side eye that's not true there's nowhere it is no way to verify that without revealing his uh history which would be a violation of his privacy rights yeah so um no no no no that was really good but like I'm totally more optimistic than you are um and I think like there's the whole web three thing there's a government thing I'll hit on the government thing you had asked about some stuff that was built um I mean the the truth of it is like a long time ago um like 20 years ago um again disclosing some some private information about my age um I managed a program in the Middle East we built a reconnaissance system for uh a government in the Middle East um largely using satellite data but a number of sensors and they were tracking facilities and assets of uh potential targets and potential foes in in the Gulf um so that that that tools or that tooling that we built aggregated all this data both data and metadata so you take a picture you can tell what's on the ground you know based on the um the shape of the airplane what kind of airplane it is based on other assets that are around that airplane what might be going on and all that kind of stuff so and then you're doing some predictive analysis on what that country might be intending to do so fast forward about 10 years from then um the architect on that project he and I got together and he was the brains of the whole thing but we started aggregating data that we could get off the internet so we pulled together at that time I was about 26 different sites we effectively surveilled about 30 million Americans we put together very detailed profiles on on people um the intent was initially it was just it's just marketing right so um and initially it was like people that travel so people that travel they take their pictures they put stuff up on the Internet we can kind of tell what they're doing and the pictures all the metadata associated with it whether they're wealthy whether they're not wealthy what kind of again what kind of travel they like um and it started getting a little creepy in fact um the my my business partner wrote up utility or an internal tool called the creepy crawler that allowed you to type in somebody's name and it pulled up a full kind of set of information about who they were where they lived um again like likely how much money they had because you can tell things like that based upon the your home purchase as a public record most people do it in their own name so we know how much your home is worth your car records or public record you can get that information um where you work everybody puts that stuff on LinkedIn it's publicly available so we know where you got your education what companies you're working for we know generally what people make because they report through things like Glassdoor what they've made for a particular role at a given organization we can put together a lot of detail about people we started with advertising we moved to um predicting how good people were at their jobs with the goal of trying to align Freelancers with companies and how much those companies should pay those Freelancers based on how good they are at their jobs and we got contacted by a government contractor and the government contractor wanted to know can I use this system to determine somebody's political bias because we find that certain types of people do better at our organization and other than other types of people this was all pre-cambridge analytica we shut it down at that point we didn't want to have access to the data we didn't want to be asked for the data we're pretty concerned so when Cambridge analytica came out it was no kind of big surprise now it was just one data source but that's what we're working on but the reason I'm more optimistic is because we have found people like in US government for example on the hill who are advocates for for privacy and for the rights of U.S citizens who have fought against things like the Patriot Act who have been vocal opponents of things like BSA and places where there's overreach I do think that we can get there with a combination of the right incentives and some of the right people in some of those roles I don't I see that more on the hill I don't see that as much on the regulatory side because on the regulatory side people are going to use the tools that they have available and there's no doubt that all the three-letter agencies have relationships with social media companies and that kind of thing and are also mining that data I don't know if any of you were concerned but I'm glad I wasn't on u.soi 20 years ago you might need to text your mom and dad about that um all right let me Veer away from government before Josh actually gives me a look in case DC is actually watching this um let's talk about Google our favorite topic right um you know back then it was loaded for his technological prowess and for being extremely Innovative I remember being excited about Google you know when somebody said to me Google it I said what is that what was I using then Yahoo I can't remember um but we all should be aware that it actually largely pioneered surveillance capitalism um it was so revolutionary it actually brought forth a whole generation of specialists at tech companies um I should know I think it's one of the first unicorns uh companies in French Tech um was actually quitio which is an ad Tech huge ad tech company um today it is deemed as a big bad tech company you know as we actually realized how bad the situation is and I think it is the worst that it has ever been so Travis you moved from web 2 and you know using all our data and you know loving it to web3 has surveillance capitalism actually reached saturation point or will the Advent of web 3 companies innovate it further causing even more danger to us as a society yeah I think I think we're not there yet obviously Google is a juggernaut spinning off tons of cash and it's not even clear what a lot of the employees do there but they try new stuff they're trying to innovate and they have this massive massive Cash Cow that they've developed over time um you know when I was uh work on the QuickBooks brand we were using I did a lot of work in ad Tech and looking at ad Tech Technologies we used a company called kochava to do all of our mobile ad tracking and so that's like a you always want a kind of third party to arbitrate between the different places you're buying ads to tell you when a user purchases from you uh you know was that a Facebook ad they saw was that that LinkedIn ad was it a Google ad and uh you know it's of course tracking immense amounts of information about all these different users and pulling it into a central place a third-party place where they're storing it on their servers and I was there when coachaba announced their exchange platform which was their ad buying platform play and it was shocking uh like the executives at QuickBooks were scared they were nervous they had no idea why they were talking about blockchain um and you know I think that they are still working on that but they are first a at the you know their first this kind of tracking platform that is then trying to back their way into a web3 ad Network that's somewhat privacy preserving I think there's other uh plays out there that have have tried to dabble in that space uh but I think it's going to be pretty hard to unseat the web 2 platforms um and I think it's gonna it's gonna take more time so I'm still hopeful that we can get away from the pieces of surveillance capitalism and the collection of data and then the AI modeling that goes on top of that right to do prediction over what your next action is going to be and then trying to modify modify that pathway Google is really good at that I heard that they have a pre-search team which sounds very sci-fi and scary you know when you sit down with that prompt they have a you know they have a reasonable chance of guessing what you're going to search before you even search it um and if you think about that that is pretty scary oh guy given what you did in your time at MIT in an enigma and then now being found on the secret Network I think you have a lot to say about this yeah so I mean I I'll actually start with a bit more optimistic view I mean he does go back to incentives I think and until I think a few years ago there were not really big incentives for big corporations like Google and others to change the ways I think that is slightly shifting not enough it's like baby steps but like whether it's regulation whether it's web 3 whether it's like all these uh privacy enhancing technologies that were sci-fi until a decade ago but are actually becoming realistic and practical in these days even companies like Google are putting a lot of research and then turning that into production effort into privacy preserving Technologies so and I do think this whole privacy preserving confidential Computing you know whatever you want to call it movement goes bigger than just web 3 it goes back to web 2 but I think web3 just says the the the let's say we have the best chance and most likelihood to basically steer those big companies in the right direction because without that they're not incentivized to do it but I do want to show a little bit more optimism on that front um with that said with that said like I don't think we can wait around like I think look big Corporation at the end of the day they need to take care of their shareholders that's like their primary concern and even the the even if these were like at some point 20 30 years ago like great startups uh where people um had a lot of let's say Good Intentions in mind like the famous Google do no evil which kind of um went away um then then it's you know it's it's it's it's reasonable from their incentive maximization profit maximization to do what's best for their shareholders and sometimes in many cases that does not align with privacy and I think what we as web3 should do to Google is kind of like what open AI is doing to Google right now with GPT so Google Facebook all of that they always kept their models like they gave they started to give the algorithms like public like tensorflow all that but you never give the model they never give the actual Source they definitely never give the data and it's good thing they didn't give the data but now that like you've seen with AI like with Facebook releasing the model in open source and it's almost like a race to the bottom to make these more uh public goods and common goods that's what we as web3 should do we should kind of force their hands by giving better Alternatives or better Technologies so that they would be forced to kind of correct their ways or kind of see the light in some following that's my my belief so you mentioned incentives so obviously surveillance capitalism Catalyst capitalism so it's driven by profit-making incentives right so the crypto industry has seen the emergence of token economics so I'm gonna be very careful when saying token because my general counselor here gets on Highlander token yeah we don't mention the token we don't mention the token price we don't say the word Moon gotta be careful all right apparently we can't use emojis too right yeah no apparently not not so um Kent tokenization offer alternative ownership and business models to surveillance capitalism all right general counsel go ahead okay so I think in theory yes absolutely and that's that's the kind of cool thing about web3 is that there is theoretically a different incentive structure while maintaining uh you know being a capitalist right because we're not going to change that unless you guys want to change that meet me outside later we can talk about which protests we're going to but if we're going to you know like if we're not changing capitalism we need to find some other incentive structure right and that's what tokenization might do um I don't know so well I have other comments I'll just wait to make the other comments but the short answer is yes I think I think absolutely yeah to put up a disclaimer before Oh no real disclaimer I think you're like I think in theory yes tokens do uh create a different incentive structure um absolutely Travis yeah I mean uh getting back to Google and maybe some positive things to think about so I mean I think chat GPT has shaken Google to its core I don't know if you guys use Google I do I wanted to learn about you know foundations a little while ago I'm searching about foundations I have to go through like 10 different websites I got ads popping up I got all this JavaScript running I started talking to chat gbt about foundations and suddenly I know everything and it's just going back and forth it's telling me all this information that I want to look up um you know and and what's great it's not like I can load a website and pay it 10 mil of pennies hey hey Mr website I love what you're doing I want to pay for your server costs I want to give you some profit you know here's 10 Miller pennies can't do it they have to have this totally backwards ad mechanism you know it's kind of like the internet was sort of built and then it got moved in this weird Direction because the business models didn't work and you could only send people you know 25 cents and then the credit card company would charge you 25 cents you can't send small payments so you have to kind of do this whole ad model and I think that they're you know on the looking on the positive side not even from the web three space these incumbents can be disrupted and there's going to be a lot of opportunity for us to come in with new business models and new ways of transaction and I think that you know really small payments uh could be our way out just direction of this discussion a little bit maybe touching back onto Government and regulation when we talk about surveillance capitalism we must of course reference shushan azuboff um she poses the question will we be the masters of information or will we be it slaves I think we're here today as privacy preserving companies and developers were interested in privacy because we understand that and we believe that the form is actually possible and within our control you know starting by building with privacy by default and by Design however implementing measures against misuse of Enterprise surveillance is very difficult for countries because it requires a structural change to the system what is the fastest route for us to reclaim our privacy is it regulation or can we build our way out of it especially with the unprecedented Innovation we've seen in the web 3 space Josh yeah you're asking if we can trust the government to build this solution for us we probably have a common perspective on that in this room it would be my guess so we've got to build it the reality is that here's the scary thing about web3 right it actually has the potential to be worse than web 2 as it relates to privacy because at least with web 2. if I go to Amazon and I buy something it's between me and Amazon but it's not the whole world now we put something on web3 and it's for everybody to see for all-time on a mutable database that can never be removed so it's not even compatible with gdpr and EU so the regulations that are there anytime a regulator is getting involved is going to be like inherently brittle right out of the gate though there'll be a tendency towards overreach it's really incumbent upon the builders here the builders in this room why I'm excited about things like UPA to build the fundamentals into the course so that we do have privacy protections by default and giving the user the consent the the power to be able to consent to uh to disclosure of that that information but it's got to start here it's got to start with with you guys in this room guy would you like to add on any comments no point same same perspective like we should talk to Regulators we should try to educate them but at the same time we can't wait for Regulators like we have to build the future and I guess hope they see the light that's very benign um so okay um I guess my question was what's the fastest route so we just think it's a bit of a middle ground and we need to find some sort of constructive solutions to you know create and continue creating traveling businesses and to also demonstrate the better Solutions than blatant surveillance capitalism but that's going to take a lot of time doesn't it well just to chime in I think it's not just the fastest route I think it's the only route I don't think that depending on the government and again when I was talking about incentives I'm only talking about the government my whole life I've spent either as a human rights lawyer or a criminal defense lawyer or somebody involved with you know the the principle of due process and then finally an academic and I have never felt like I'm impacting the world as much as I do at a private company that happens to be in the web 3 space believe it or not and the reason that I've transitioned into this role is because I actually believe that we can effectuate change through technology I don't for the for half a second believe that we can effectuate real change through regulation or through politics and I'm not saying that because I'm a hater I'm just saying that because I've been alive for I don't know x amount of years less than this guy amount of years but sufficient amount of years just to sort of I think be very legitimately uh I wouldn't even it's just everything I know is that the government does not move at all right let's say they move very slowly just to sort of to be fair so yeah it's definitely going to be the fastest way to change and potentially the only way I think given the reality so last question for the panelists we're running out of time so to quote shashana again she said let's close doors but let's make sure they are the right ones so this is a question for everyone on the panel what should we stop doing and what should we start doing that was a surprise question they were not prepped for this I'm sure I I can take that I mean you know as developers and Builders delete more stuff don't store stuff number one and um I I think that the regulation one is tough refer that to uh lawyers here but um you know and I think when we think of surveillance capitalism you know remember it's a business model and business models can be disrupted they can be destroyed pretty quickly I think it takes much more effort to close doors than to open them so and I'm a builder too so I guess I don't have a good answer about what we should close I think we should just continue to build and I I think I think things will change within a few years like as long as we stay the course Ahmed yeah um more privacy by default less surveillance capitalism and that is a legally compliant answer like we should stop being so defeatist like is it on some other kind of uh panel where we were talking about like why why does nobody care about privacy and that's in this total bunk um people do like in the the economics are changing you see like Apple's campaigns and really because they have a different economic model right they have a different structure they want you to buy a little adapt power adapters for for every for every photo so they can make money off of that they don't have to make money off your data um so like build different incentive structures if you really care about this um I think that's what it's going to take to do uh that's those are the doors the other thing is just keep the doors open so it's important that we have conversations with regulators and policy makers so that they don't make rash bad decisions shut the doors that are impossible then to open so we don't have situations like BSA or or things like that where it's like impossible to get that thing switched because once a regulation is in place it's really really difficult to change course so we need to keep those doors open um keep Minds open while we're building faster than faster than the The Regulators can move so I'm a bit kind of Michelle I'm not going to start any fight here however I I'm not penalties but I do want to say that I see privacy as a movement that we all should do collectively it's a bit like the climate chaos right like back in those days we thought everything was great you know and then now you know everyone's coming together and just pushing the narrative and things actually are starting to happen but it's a bit too late so I hope that with privacy it's not going to take the same route that we're going to start actually understanding well developers here start building you know let's not leave a legacy of damage and remorse and you know sort of uh sort of just like whinging about what we should have done earlier um like what we see in the climate chaos today yeah all right I hope you have a bit of understanding of what surveillance capitalism is um today you know in digital lives and it's not going to go away so keep building and speak to anybody in UPA here and they can get you started on actually making a difference thank you everyone [Applause] foreign [Music] yes Katan has always been a minute it's happening right now [Music] foreign [Music] foreign [Music] foreign