Privacy Highlight: Privacy vs Security with Eitan Danon, Lia Holland, and Mark Young

all right how's everybody doing entertained are you not entertained um so it's it's uh I'm Mark Young it's a distinct privilege um to be with these wise experienced and distinguished panelists um so right off the gate let's let me ask each one of them to just say about uh 30 seconds on uh who they are and where they're from I'm a senior cyber crimes investigator at chain Alice's um chanalysis is the leading crypto data analytics company we sit at the intersection of crypto businesses governments and financial institutions we support complex investigations compliance and and education we've got over a thousand customers and 75 plus countries my name is Trent timer I'm here with the mobile coin Foundation I retired from the FBI I spent 27 years with that doing cyber investigations criminal investigations I run a consultancy that does National Security strategy and investigative advice to companies like yours and how to understand the ecosystem dealing with government policy and regulation hello everybody uh my name is Kurt opsahl I am the council for cyber security and civil liberties with the file coin Foundation I'm also a special counsel with the Electronic Frontier Foundation and for about the last uh 18 years I was also a lawyer with the Electronic Frontier Foundation Howdy Folks I'm Leah Holland I use there she pronouns I am the campaigns and communications director with the national digital rights nonprofit fight for the future where we advocate for privacy against surveillance and uh stand up for the right to code and uh all the protections of the First Amendment for people who build privacy tools thank you so we have just like every other panel that you've witnessed this afternoon we've got much ground to cover and not a lot much time to cover it in so we'll kick it off I'm going to do a lightning round in the beginning and then a lightning round at the end so the first thing um is I'm going to Define if this isn't these are not legal definitions but I'm going to Define privacy and security and then I'm going to ask each panelist to answer one question about it so I'm going to Define privacy as the absence of undue corporate tracking or government surveillance of a digital asset transaction security we're going to Define as the avoidance of fraud theft or other illicit activities or identity exposure concerning any transaction so with those definitions let's start with Leah are these characteristics a zero-sum equation or are they mutually supportive I would say that that depends on who you are and what your threat model is so yes and no all right well I I would say actually I would you know have broader definitions I think that the Privacy is a right to be left alone which includes but is not limited to you someone getting into your business uh as to what Financial transactions that you're making and also that that security is is to protect yourselves from from danger and those dangers can be broader than than fraud or such it could be a danger from the government uh coming to arrest you because they find you an opposition figure and so this is one I I think the privacy and security go together that you need both that uh security is necessary in order to effectuate your privacy that if someone can break through and get to your private information you don't have much security uh and then privacy is necessary to have good security that uh if you if you don't have the Privacy about your life about what you were doing that makes you more vulnerable to possible threats now of course I agree it would depend on what your threat model is how you're going to prioritize these two things so how it like balances out if a particular person will depend on that but these things do go together well so let me just dig into that just for second so is it a zero-sum game in other words if I enhance one do I sacrifice the other no it's not I think that you can have both of these together you can make sure that you have the maximum of each and for different people they may want to balance it one way or the other for what their threat medals may be but having them both is fundamental Trent yeah so you need them together you need privacy and security together for it to work you can't security should be there to maintain privacy it's it's that whole backup because ultimately you're trying to protect people's information the data the security there is to make sure to keep that Norm so you need both together to make it work Eton I also think they go together um I think both are critical and neither should come at the expense of the other fair enough uh Leah so let's come back to you your organization acknowledges that while Tech can transform Society up and Injustice and hold power to account it can also silence the marginalized automate oppression and compromise basic rights what are your thoughts on end-to-end encryption messaging apps how do these encryption messaging apps uh support the marginalized reduce oppression and uh preserve basic rights that's a great question and I'd like to start by saying that fight for the future doesn't just advocate for encrypted messaging apps we advocate for vigorous Indian encryption in any place online where our private personal data is stored or communicated and we think that that's incredibly essential for human rights that of course concludes financial data and financial surveillance um we believe that privacy is a fundamental human right because it is safety if we don't have privacy in our personal information the information that can be used to harm us by a variety of different actors be they hackers stalkers or authoritarian governments then we don't really have much uh in terms of rights when we're speaking truth to power so um today the data that is being collected on individuals all across the internet no matter what service they're using is is really a huge threat to marginalized people because marginalized people are by and large criminalized to be marginalized often is to be criminalized in many countries including the United States and that information is uh is a is a huge vulnerability for individuals today who are in many different identity groups and I think also that data is an incredible threat to all of us because none of us can predict the future the data that's being collected on us today could be taken as a by an employer for example through a data broker to decide whether or not you get a job five years from now or it could be used by an authoritarian government to persecute a journalist or an activist that has since relocated to that country or an authoritarian government that didn't exist when that data was first captured and then additionally there's you know the questions of you getting into and out of an abusive relationship and what um having a vast amount of private personal data out there means for for you and your personal safety it's not suspicious in our opinion and it's not criminal in our opinion to seek privacy is just smart because none of us know what the future can predict and we all should live in a future-proof way that's good good well excellent so speaking of encryption I'm going to stick with you in February 2016 the FBI wanted Apple to unlock an iPhone connected to a mass shooting Event in San Bernardino California that killed 14 people Apple declined before a judge could hear the case to compel Apple to unlock the phone the FBI went to a third party and unlocked that phone incidentally no information relevant to the investigation was found on that phone but would you support the FBI's request in that case why or why not well mass shootings are awful but uh I'm sorry no because I really don't believe and as an organization we don't really believe that the fact that bad people exist and are going to do bad things means that none of us should have rights and we further don't believe that it is appropriate to treat every single person in this country as if they are guilty until they are proven innocent by constant surveillance the flaw here that's really difficult to Grapple with is that we as humans often tend to think that Tech will save us it'll save us from things like the desperation that leads to extremism and that just hasn't borne out throughout history I mean we had bad people before we had centralized Banks or cell phones and I mean call me a cynic but I kind of think the bad people are going to do bad things no matter what and we really just need to be um thinking about rights that include privacy being denied to us as something that makes us less safe not more safe because they're you know integral to our basic our basic security and ever more as our our lives are as so many panelists have already referenced incredibly digital and I I have to like kind of turn that question around in this environment where we're so concerned about being hacked or stalked or abused or or or or or or what have you with all this data that's just laying out there for anybody to take to ask like why would anyone trade human rights and safety for billions of people for the chance that a crime could be solved the weight there for me is is really incredibly different and I think that like there's one more Point here that I think it's important to make about blockchain specifically which is that most chains right now have a public Ledger and these same threats that we Face from data brokers in web 2 when we talk about end-to-end encryption apps or what have you are threats that web3 is facing as well I'm actually on stage here with uh perhaps web 3's most prominent data broker chain analysis which is taking information from the blockchain and monetizing the identification the doxing of people on on chain and whether chain analysis or another organization that data is being collected and it's being used to make lists and I'm really concerned that those lists are for example teachers in Afghanistan who received Bitcoin in order to keep teaching girls under the Taliban and that that list will then be used for executions or lists of people who contributed crypto to Planned Parenthood that five years down the road will be used to persecute those who help people in Texas get an abortion and I I just really feel as if we need to get down to brass tacks over the need for privacy coins the need for a greater consumer protection and education in this space and finally just Federal data privacy protection like enshrining this human right in this country is something that is so long overdue so anyway I'll get off my soapbox now thank you that's great I think I think Benjamin Franklin I think was the would agree with you he said those who had sacrificed privacy for security are deserving of neither so aten in in your 2023 crime report Shane analysis noted that illicit transaction hit an all-time high in 2022 we all must acknowledge that money laundering theft scams these are part of um the crypto ecosystem albeit at a smaller percentage than the Fiat ecosystem so should these illicit activities be as accepted in crypto as they are in traditional Finance so on a on a fundamental level there's nothing inherently illicit um or criminal about cryptocurrency technology and actually chain analysis we believe in the transformative power of crypto to Foster Innovation and increase Financial inclusion and to support humanitarian activity which we've seen in Ukraine over the past year and more recently after the earthquake in Turkey I think a lot of people would say that cryptocurrency facilitates ransomware but actually it's the unique transparency of the blockchain of public blockchains that enable investigators to tackle criminal networks and Bad actors and so if you take ransomware as an example the way to tackle ransomware is to um you know is to disrupt What's called the ransomware supply chains you're looking at authors and developers malware entities money laundering Services infrastructure providers Cash Out points and so the transparency of the blockchain would allow an investigator to look at all that information follow the money in real time and work with work with C5 and defy organizations and with governments to disrupt that activity and it's a proven successful method I would say to the extent that cyber crime moves in the direction of cash like you were talking about um you know the Fiat system in that direction of cash and shell companies and traditional money laundering typologies that would complicate the efforts of investigators but transparency is key good good so is there anything that from your perspective is there anything that Builders can do to drive down that illicit activity that Builders can incorporate um hands down I would say our recommendation would be code audits I think going to the transparency Factor defies fast growing it's extremely compelling and if you flip that around that's also the greatest source of vulnerability and the the magnitude of scams and hacks that the space has seen in recent years begs for more security more you know hardening of defenses I think there's a need and a niche for independent trusted third-party providers to give um I mean it's not a sexy job description but code auditing to prevent malicious actors from stealing funds and cashing them out for what it's worth also until recently many centralized exchanges were hacked and there was a concerted investment in security and we've seen a decrease in those hacks so there are there's kind of a a profit and a non-monetary dividend I think to be reached from that kind of investment so I'm going to ask you to Telegraph chain analysis crime report for next year what what illicit activities do you think will be increasing in this current year that we're in so going off of our data from last year um the two categories that I think we can expect to stay at least stagnant but probably rise our sanctioned entities and stolen funds from hacks on the sanctions front assuming the war on Ukraine does not Abate which it does not look like it will do anytime soon and with ofac and similar Ministries and departments worldwide designating kind of the the tenor of the sanctions regime designating not only individual actors and wallets but at the service level which will raise exposure I think that's a trend that we anticipate will continue in the next year on Stolen funds and hacks hackers show no sign of letting up in particular cyber criminals affiliated with North Korean cyber crime syndicates they've stolen billions of dollars worth of cryptocurrency in recent years which is a worrying Trend I think it's also worth noting that ransomware payments are on the decline in the past year I'm not attacked but payments and we attribute that to a couple of factors one of which is a circular that kind of raised the risk of sanctions exposure that if you are extorted and are a victim you risk yourself being designated or at least being exposed to designations and the other one is that cyber insurance companies are are being much more judicious and tightening up who they will ensure but the fact that payments are on the decline I think on a macro level is a good news story and hopefully will support the push to harden defenses and and longer term make ransomware kind of not a profitable industry to pursue let's hope thank you Trent as a former FBI special agent how do you feel about technologies that obfuscate the identity of individuals who may be violating the law with crypto including ransomware attacks like we saw against Colonial pipeline in 2021 so let me flip the question a little bit so as an FBI agent I'd like to see 98 of the transactions secure and private and then that makes my job easier to focus on two percent that are bad same thing like I'd like to see so it's if you look at the the builders and the different crypto ecosystems out there depending on where you want to be if you want to be more mainstream then you're going to need to follow more rules regulations privacy policy compliance if you're going to be more on the outside you're going to attract more Bad actors and the one challenge that I put to everybody else is I really love to see 98 of it secure private you know because if as an investigator I just have to be better at doing it but I'd also uh challenge the builders to actually build something that doesn't enhance or encourage bad acts that you don't want on your networks anyways because it actually messes it up for everybody else ransomware you say ransomware you think crypto and the majority of like here in the United States they put two and two together and they shouldn't and it causes problems for everybody so how do we how do we stop that and how do we make it you know hey I'm glad you're doing private secure transactions it's Innovative it's here to stay we want to support it but how do we mitigate that criminal activity and what's going on I give you the colonial pipeline perfect example ransomware crew from Russia shuts down oil gas up in the Northeast damn near Act of War I mean that's that's how close it came trying to do the ransomware so everybody involved in that she had the highest levels of the United States government talking the highest levels of the Russian government to try and stop this because it messed it up for the entire ecosystem you just can't do that so anything that would stop it to actually not make it as a favorable look you don't want to be seeing cryptocurrency and crypto Builders don't want to see as elicit and money laundering you're actually trying to do private transactions to help people in Ukraine marginalized communities all this other things for all the right reasons you want to promote that but not promote the bad acts so but you but you're not suggesting that developers should be required to put in features that would help a law enforcement investigation are you oh no absolutely not but when you're designing it you might want to think about it because the thing is is like you got to think of as you know we're all in this together and you know I've worked many cases where I've gone after hackers crackers whatever and they've done some pretty bad stuff and the people that were most incensed were the guys that ran the networks because I came in and destroyed their entire system and they did more to help me track them down to get the bad guy and that's what we're talking about you know it's it's that it's a realistic approach to what we're trying to do you have to you can't be absolute because it won't work in this world you have to you have to look at it with a uh a moderate approach I guess so with with Eton sitting next to you I'm just curious in your career you made use of an awful lot of cyber threat intelligence is is there an analog um in digital assets that would help any investigation or frankly the industry focus on the most significant threats which will evolve over time as we've seen is there any analog to a cyber threat intelligence product that we should be looking at so I mean one of the great things about blockchain blockchain it's a public blockchain you tell that to an FBI agent they're most of them are CPAs it's an immutable Ledger they got that down we got that from day one we understand how to look at ledgers the reason why the blockchain is public was for all the reasons why it's public so you're sharing it across but for the threat intelligence I want to focus on the two percent you know we're having to chase all this you know noise and traffic as opposed to going after the bat you know there's a limited amount of Agents I'd have on a squad or having my field office to chase after the problems I want to put my resources against the worst problems and not go after everything else so if there is a way to help us make sense of where bad acts are going on and literally I get calls all the time you know back when I was on the job where hey something's going on you need to look over here this is bad for everybody take a look at it and that's what we look at and that's that's really what's of of importance good thank you Kurt thanks for your patience this question might be undone by your opening remark but but I'll ask it anyway what are the consequences of an imbalance between security and privacy to web3 developers to users and the general public for example if we over biased on privacy um what's if we if we really amped up the Privacy features capability of a protocol what are the downsides of that why is it I am a strong advocate of increasing the privacy of the protocol in fact I think I was great we had the Privacy by the design panel right before this one to explain how to do that from the get-go and to look at what that and I think this will also increase the security right that by building in security and privacy features into this it can make it safer more secure and as you were just saying that like having uh it's so that there is less attack service by auditing uh code so they're less problem this helps keep our security better and provide can provide more privacy so putting these things together and building privacy strong privacy by Design so that people can be left alone if they want to if they want to disclose some information they can do to they have the choice about what they want to do with that information and that control and sometimes if it is necessary to deal with a security incident they may want to disclose some information if it's not necessary they want to keep it to themselves and this is something that is fundamental for for protecting people and allowing to take advantage of some of these new technologies and privacy is a right that effectuates other rights it allows you to have freedom of expression by consuming media that you choose by supporting organizations that you're politically supportive of allows you to uh like be the Cornerstone of being able to have a autonomous mind where you can think for yourself without having somebody look over your shoulder so that's why it is incredibly vital to have privacy built in from the from the get-go into all of these Technologies and then that will also give you security so in between thank you in between the lines of your comments though um is the the elephant in the room is surveillance so I'm going to ask is all surveillance created equal for example is Google's tracking of my internet searches is that the same as Government monitoring my crypto transactions so I think there are many differences in surveillance and I think that's an important distinction is that corporate surveillance is very invasive and I understand why people want to protect themselves very strongly from them and they should but the corporations don't yet have the ability to arrest you don't have the ability to put you in jail in the way that a A nation-state can uh and when it comes to the nation's threat model uh there are many nation states out there some of which are pretty authoritarian who will do some pretty nasty things to people so these protections can save lives um so I'd also make an important distinction uh Mass surveillance versus targeted surveillance that mass surveillance is what a lot of these surveillance programs and modern surveillance are trying to do where they want to get full information over a wide swath so that they can look at that information later and not have no suspicion at first but just have a database that is available and they can look back in time they have a time machine so if somebody becomes suspicious they can look at everything that they've ever done and as we're just talking about there might be an authoritarian regime that arises after you put this data in there when you weren't thinking that in your threat model and if you have that database that's been around forever and you trusted the government so they'll do a good job with this don't worry about it that database still exists when there's now a new government one is not trustworthy and they can look back in the time machine say oh you did something that was legal then but we've decided it's not legal now and this is what can protect you from the future well said thank you so the time has gone super quick we're going to end on another lightning round um so I'm I'm going to ask a question about this on August 8th last year the office of foreign assets control put tornado Cash Smart contracts on the sanctions list they had put um that they had put some custodial wallets and non-custodial Wallets on the list before but this was the first time it was a non-custodial protocol last September a month later coinbase funded the lawsuit challenging the tornado cash sanctions primarily claiming that treasury had overstepped its Authority so my question to each of you each of the panelists is if you were the judge in this case how would you rule let's start with atan I'm thankful I'm not a judge first of all that's uh does not strike me as a fun assignment in this case um I understand both sides I don't I mean virtually no one here would say that privacy is an invaluable and on the face of it mixers should not should be a there's no reason they shouldn't be able to provide that service including tornado cash on the other hand 25 percent of mixed funds came from illicit addresses and and tornado cash was used um by North Korea uh linked cyber criminals kind of repeatedly and repeatedly so I understand that but um I don't know mistrial or I wouldn't I don't I can't say well I'm just reminded of Leah's remarks though that in some ways putting them on the sanctions list punishes the innocent because of the guilty but Trent please you're the judge what do you think yeah I I I think I'm going to turn it a little bit because one of the problems with rule making agencies actually now there's a process they follow before you put on the list but this is where the legislative branch needs to further articulate how you go into this because the problem is is your same thing with the ransomware I'll go back to that example somebody's paying a ransomware extortion because they have to get their company back into business they don't know who it is but it turns out to be the North Koreans well now the victims being victimized and maybe sanctioned because they're just trying to do the right thing it's a difficult uh difficult decision for the judge and you know we have to look at it differently the sanctions sometimes are overused in my opinion very good Kurt so I'm a civil liberties lawyer so I look at it from uh from that perspective and I would hold that uh code is speech that uh this is a code that has been put on the sanction list and the government has not shown that this is the least restrictive means of achieving their purpose and that means it does not survive certainly and so we're striking it down the Supreme Court has said as much Leah please yeah and I just add that um human rights often make governments uncomfortable because they are so good at violating them uh and that the issue at hand here really is one of a basic human right that we should all have and and and and and based in a privilege that many of us myself included don't have of whether or not you feel safer with the government watching watching over your shoulder whether you feel safer with corporations watching over your shoulder many of us don't many of us don't have that privilege and that's why we at five for the future uh spun up a letter with 60 plus privacy preserving projects and organizations this spring in response to the tornado cash sanctions calling on the government to return to our long tradition of honoring the First Amendment and having privacy tools built here and celebrated in the US you're here thank you thank you all for letting us go over a little bit of time um so thanks to all the these excellent panelists uh this was a privilege and rock on builders and I have stickers I'm over there they're sparkly [Applause]